Testing a chain against an old OpenSSL, in a container

A chain that validates on your laptop tells you nothing about a partner running a 2016 trust store, and a container with an old OpenSSL is the only honest test.

$ docker run --rm centos:7 sh -c 
    'curl -sS https://example.com > /dev/null && echo ok'
curl: (60) SSL certificate problem: certificate has expired

$ docker run --rm ubuntu:18.04 sh -c '...'
ok

# and the chain your server actually sends, which is
# not necessarily the one in your configuration:
$ openssl s_client -connect example.com:443 </dev/null 2>&1 
    | grep -E '^ *[0-9] s:'

Testing against the chain the server sends rather than the files on disk catches the case where a reload was missed or a load balancer terminates TLS with its own configuration. Keeping two or three old base images in a smoke test is cheap insurance for anything with server-to-server integrations, and it is the only way to find out about a compatibility break before a partner does.