fix: cert_status reports valid certs as EXPIRED when the chain can't be verified (closes #881)

[JamBalaya56562]

What

/app/cert_status no longer reports a still-valid certificate as EXPIRED just because its chain fails to verify.

Why

cert_status ran openssl verify -untrusted chain.pem fullchain.pem and labelled any failure as EXPIRED:

if verify=$(openssl verify ...); then
    echo "$verify"
else
    echo "${cert}: EXPIRED"   # ← every verify failure becomes "EXPIRED"
fi

But openssl verify also fails when a trust anchor in the chain has expired (the classic DST Root CA X3 expiry, Sep 2021) even though the leaf certificate itself is still valid. Users with valid, freshly-renewed certificates saw them reported as EXPIRED (#881), which is misleading (the certificate/renewal logic itself was fine).

How

Determine expiry from the leaf certificate's own notAfter using openssl x509 -checkend 0, rather than treating a chain-verification failure as expiry:

• If openssl verify succeeds → OK (unchanged).
• If it fails but the leaf is still valid → OK (chain verification failed) (was wrongly EXPIRED).
• If the leaf is actually expired → EXPIRED (unchanged).

Added test/tests/cert_status/ — a deterministic test (no ACME server needed) that generates a valid self-signed cert (chain unverifiable) and an expired one, and asserts the valid one is not reported EXPIRED while the expired one is.

Testing

• New cert_status test passes locally and is registered in test/config.sh + the CI matrix.
• Manually confirmed the output:
  • valid leaf, unverifiable chain → ... OK (chain verification failed) / Certificate is valid until …
  • expired leaf → ... EXPIRED / Certificate was valid until …
• shellcheck clean on the modified script and the new test.

Closes #881

🤖 Generated with Claude Code

[buchdag]

I'm not sure we want to add a test here, the app/cert_status util is kinda provided as-is and is not part of the core features of acme-companion. WDYT ?

[JamBalaya56562]

Good point — dropped the test and kept just the app/cert_status fix, since the util is provided as-is. Also rebased onto main to clear the conflict. 🙏