Bad server certificate trying to get to the top-level https://shibboleth.net from AWS or a zscaler address

[Cantor, Scott]

>    14: curl#60 - "SSL certificate problem: certificate has expired"

The chain we're serving up is fine so far as I know (and I just checked it with openssl, the exact set we're returning are all unexpired). You can verify that for yourself.

>    Or when running with zscaler we get the following error:

The root of the vhost redirects to www.shibboleth.net, there are only specific content directories on the server that don't. I have no idea what zscaler is but it's irrelevant.

-- Scott