[user5994461]

Would be nice to patch openssl and python to skip expired certificates too when there is a newer one available.

[mperham]

I believe this was fixed in openssl 1.1.1 but there are millions of devices still on 1.0.x

[EdwardDiego]

Yeah, we're seeing it in coworkers still running OSX Mojave (albeit with older LibreSSL instead of OpenSSL) using the default curl. Catalina users seem okay though.