--- title: Resolving the AddTrust External CA Root certificate... description: The AddTrust External CA Root certificate expired on May 30, 2020, causing alerts for servers that include it unnecessarily in their certificate chain. The... canonical: https://daily.dev/posts/resolving-the-addtrust-external-ca-root-certificate-expiration-seo9lvxll twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Resolving the AddTrust External CA Root certificate expiration | daily.dev og:description: The AddTrust External CA Root certificate expired on May 30, 2020, causing alerts for servers that include it unnecessarily in their certificate chain. The... og:url: https://daily.dev/posts/resolving-the-addtrust-external-ca-root-certificate-expiration-seo9lvxll og:image: https://api.daily.dev/og/posts/sEO9LvxLL.png og:image:alt: Resolving the AddTrust External CA Root certificate expiration og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Resolving the AddTrust External CA Root certificate expiration **[Oh Dear](https://daily.dev/sources/ohdear)** · 7 min read · 0 upvotes · 0 comments ## Summary The AddTrust External CA Root certificate expired on May 30, 2020, causing alerts for servers that include it unnecessarily in their certificate chain. The post explains how to verify the issue using openssl commands, why the expiring root certificate is technically not needed for modern clients, and how to fix it by removing or replacing the certificate from your web server's intermediate certificate chain (Nginx or Apache). It also explains why Oh Dear monitors all certificates sent by a server and announces upcoming configurable alerting behavior for root certificate validation. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Changes to TLS clientAuth Certificates: Ensuring You’re Not Impacted](https://daily.dev/posts/changes-to-tls-clientauth-certificates-ensuring-you-re-not-impacted-ebetmr0aj) · Cisco · 0 upvotes · 0 comments - [A Caddy Cert Expired Because systemd-resolved Was Selectively Broken](https://daily.dev/posts/a-caddy-cert-expired-because-systemd-resolved-was-selectively-broken-xkvx5lsal) · Lobsters · 1 upvotes · 0 comments - [The Morning After We Pull a Root of Trust, Nobody Owns It](https://daily.dev/posts/the-morning-after-we-pull-a-root-of-trust-nobody-owns-it-xssy4h4f3) · Dark Reading · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cryptography](https://daily.dev/tags/cryptography), [#nginx](https://daily.dev/tags/nginx) [View this post on daily.dev](https://daily.dev/posts/resolving-the-addtrust-external-ca-root-certificate-expiration-seo9lvxll) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Resolving the AddTrust External CA Root certificate expiration","url":"https://daily.dev/posts/resolving-the-addtrust-external-ca-root-certificate-expiration-seo9lvxll","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/resolving-the-addtrust-external-ca-root-certificate-expiration-seo9lvxll"},"datePublished":"2026-07-14T08:21:55.136Z","dateModified":"2026-07-14T11:57:40.962Z","description":"The AddTrust External CA Root certificate expired on May 30, 2020, causing alerts for servers that include it unnecessarily in their certificate chain. The...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/57488dc7c6e3b2a6196d75609f16af4b?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/57488dc7c6e3b2a6196d75609f16af4b?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Oh Dear","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Oh Dear","logo":"https://media.daily.dev/image/upload/s--ZL1kyzYt--/f_auto,q_auto/v1780213613/logos/ohdear?_a=BAMAMiWQ0","url":"https://daily.dev/sources/ohdear"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/resolving-the-addtrust-external-ca-root-certificate-expiration-seo9lvxll","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cryptography,nginx","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Oh Dear","item":"https://daily.dev/sources/ohdear"},{"@type":"ListItem","position":3,"name":"Resolving the AddTrust External CA Root certificate expiration"}]} ```