Bad server certificate trying to get to the top-level https://shibboleth.net from AWS or a zscaler address

[Peter Schober]

* Paul Wilt via users <users at shibboleth.net> [2022-02-24 23:46]:
> Could not retrieve mirrorlist https://shibboleth.net/cgi-bin/mirrorlist.cgi/CentOS_7 error was
> 14: curl#60 - "SSL certificate problem: certificate has expired"

$ curl -sv https://shibboleth.net/cgi-bin/mirrorlist.cgi/CentOS_7 2>&1 | fgrep -A3 "Server certificate"
* Server certificate:
*  subject: CN=shibboleth.net
*  start date: Feb 11 02:38:43 2022 GMT
*  expire date: May 12 02:38:42 2022 GMT

I.e., that cert is unexpired (and the chain is fine, as Scott said).
You can always use SSLabs' SSLtest from a browser, if in doubt.

* Paul Wilt via users <users at shibboleth.net> [2022-02-25 02:25]:
> I think that the curl error (expired certificate) may be one of the
> mirrorlist servers.

Doesn't sound likely to me when the error above reads "Could not
retrieve mirrorlist"?

Anyway, none of the 3 servers listed there have expired certificates.
One of those 3 (the one I operate) does not offer TLS at all currently
(because the distributed packages themselfs are signed and I don't
believe secrecy about what packages you install will buy you much once
someone knows you're taking to a Shib package mirror) -- but that
wouldn't cause a "certificate has expired" error.

-peter