Certbot certonly renewed certificate, but openssl shows Certificate has expired

Welcome back.

First, your certificates are fine and I see the updated one issued Dec 3. See this site as another way to confirm

The error is from openssl and is saying one of the certs in the chain, the DST Root CA X3 has expired. That cert has expired (see below) but is not a problem generally. This website uses a similar chain ending in that same DST Root CA X3.

Older versions of openssl do have a problem though and there are various work-arounds. The easiest is to update your CA Certificate store although I do not know how to do that with your Linux version. An update should remove the DST Root CA X3 from the system CA root store.

If you are using openssl 1.0.2 you have another option which is described in this blog from the openssl group

There are numerous posts about this expired DST Root CA X3. Here is just one providing more background

3 Likes