title: Axios: SSL TrustStore Configuration for Certificate with expired Root
body: <p>I'm fighting with Axios and some destination server which presents a certificate issued by <strong>AddTrust External CA</strong> which expired last year in may. Running <code>openssl s_client</code> will print me the following chain:</p>
  <pre><code>CONNECTED(00000005)
  depth=1 C = SE, O = AddTrust AB, OU = AddTrust External TTP Network, CN = AddTrust External CA Root
  verify error:num=10:certificate has expired
  notAfter=May 30 10:48:38 2020 GMT
  verify return:0
  depth=1 C = SE, O = AddTrust AB, OU = AddTrust External TTP Network, CN = AddTrust External CA Root
  verify error:num=10:certificate has expired
  notAfter=May 30 10:48:38 2020 GMT
  verify return:0
  depth=3 C = SE, O = AddTrust AB, OU = AddTrust External TTP Network, CN = AddTrust External CA Root
  verify error:num=10:certificate has expired
  notAfter=May 30 10:48:38 2020 GMT
  verify return:0
  ---
  Certificate chain
   0 s:/CN=&lt;ACTUAL-CERTIFICATE-CN&gt;
     i:/C=GB/ST=Greater Manchester/L=Salford/O=Sectigo Limited/CN=Sectigo RSA Domain Validation Secure Server CA
   1 s:/C=GB/ST=Greater Manchester/L=Salford/O=Sectigo Limited/CN=Sectigo RSA Domain Validation Secure Server CA
     i:/C=US/ST=New Jersey/L=Jersey City/O=The USERTRUST Network/CN=USERTrust RSA Certification Authority
   2 s:/C=US/ST=New Jersey/L=Jersey City/O=The USERTRUST Network/CN=USERTrust RSA Certification Authority
     i:/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root
   3 s:/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root
     i:/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root
  [...]
  </code></pre>
  <p>I removed the expired CA from my truststore and added</p>
  <ul>
  <li><strong>Sectigo RSA Domain Validation Secure Server CA</strong> and</li>
  <li><strong>USERTrust RSA Certification Authority</strong></li>
  </ul>
  <p>but I'm still ending up with <code>UNABLE_TO_GET_ISSUER_CERT_LOCALLY</code>.</p>
  <p>Other connections to trusted destinations are working fine with mTLS.</p>
  <p>As I don't want to end up using <code>rejectUnauthorized = false</code>, is there any way to make this work properly?</p>
  <p>My SSL configuration was done like this:</p>
  <pre><code>https.globalAgent.options.ca = fs.readFileSync('ca.crt')
  https.globalAgent.options.cert = fs.readFileSync('public.crt')
  https.globalAgent.options.key = fs.readFileSync('private.pem')
  </code></pre>
  <p>Any help is appreciated.</p>