Why am I getting SSL expiration alerts on API routes from specific servers?

[socks415]

earlier today our app started getting a bunch of ssl expiration halts when trying to fetch shopify api routes.  We narrowed it down to happening only from at least the data center our servers are in, but not from our local machines.  From our servers terminals, we could curl request any other https url, but if we curl requested shopify's api routes we would get an SSL expiration alert from curl.  I tried chatting with shopify and they wrote it off saying they were not having any issues.  I'm sure this will come up.  So wanted to post it.  We updated our app to ignore the SSL validation to get around the issue.

[Dom22]

We are seeing same issue

[Sp1ke]

HTTP client error:<60>:<SSL peer certificate or SSH remote key was not OK>.

I've seen the same since yesterday. When connecting manually from Postman it works well but if connecting via API inside jobs gets error. 

[JoshHighland]

Having the same issue. We are using https://github.com/Shopify/shopify-api-php

[Adam_Robson]

Same problem here. Getting CERT_HAS_EXPIRED error when trying to use the Shopify API.

[stephaniep]

Same for us

[stephaniep]

Update 1/20/23 6:41pm ET. This has resolved for me. 

[Adam_Robson]

Thank you Stephanie

[Sp1ke]

CERT validity  NOT BEFORE Wed, 18 Jan 2023 19:23:03 GMT

They updated certificate for web site recently and it looks like update took effect after 48 hours appx or just fixed something.

[stephaniep]

This issue has recurred for me as of 2/13. How did you see when they updated the certificate?

[Isaac613]

Same issue, did it resolve for you yet, 2/13/2023

[Isaac613]

Had to update PHP to a later version, was on 7.2 went to 7.4

[Sp1ke · Accepted solution]

Check Shopify notification: https://community.shopify.com/c/shopify-apis-and-sdks/important-notice-certificate-update-on-myshopi...

I had to update certificate store on my application by downloading and rewriting updated curl_cert.pem from Mozilla (details in the link above). After restarting application issue was gone.

[stephaniep]

I had to update from Ubuntu 14.04(!) to install Lets Encrypt certificates.

[jordanaf808]

I downloaded the cert from within the link you shared, found where the certs were located in my system, renamed the old one `certs.old` and renamed the new cacert.pem to cert.pem and it worked... until my XCode package was out of date. I'm updating that right now.

[Sp1ke]

You can open web site in common browser and check connection security (lock sign). There you can find certificate details.