Bad server certificate trying to get to the top-level https://shibboleth.net from AWS or a zscaler address

[Peter Schober]

* Cantor, Scott <cantor.2 at osu.edu> [2022-02-25 14:35]:
> Even the cert on www.shibboleth.net, which is not run by us, is still valid.

That server has a misconfigured cert chain, though, by producing only
the leaf/server certificate but not the intermediate one.
(SSL certificate problem: unable to get local issuer certificate)

But while JISC should fix that ASAP[1] that wouldn't cause an expired
certificate error either, of course...

-peter

[1] The reason this hasn't caused sufficient problems in practice is
that browsers cache intermediates, it seems, and that most browsers
will know the (missing) intermediate from other, correctly configured,
servers. It's still wrong, of course.