# Apple StoreKit 2 X5C certificate expired, jwt.io still verifies successfully

**URL:** <https://community.auth0.com/t/apple-storekit-2-x5c-certificate-expired-jwt-io-still-verifies-successfully/117021>\
**Category:** JWT.io\
**Created:** [September 24, 2023, 7:21am UTC](https://community.auth0.com/t/apple-storekit-2-x5c-certificate-expired-jwt-io-still-verifies-successfully/117021 "2023-09-24T07:21:25Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![betaphi](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/betaphi/32/51128_2.png) [@betaphi](https://community.auth0.com/u/betaphi)\
**Post date:** [September 24, 2023, 7:21am UTC](https://community.auth0.com/t/apple-storekit-2-x5c-certificate-expired-jwt-io-still-verifies-successfully/117021/1 "2023-09-24T07:21:25Z")

</div>

Hello everybody,  
today I noticed that some of my customer’s StoreKit 2 JWTs wouldn’t be verifiably on my server via a Swift JWT library.  
However, when pasting the same JWT in [jwt.io](http://jwt.io) it would verify successfully. However, further investigation showed that the certificate that [jwt.io](http://jwt.io) displays in the “Verify Signature” section is in fact expired.

So the question is: Does [jwt.io](http://jwt.io) report false positive or is it in fact correct to not verify the certificate expiration date when validating JWT with X5C?

---

<div class="post-metadata">

**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\
**Post date:** [September 27, 2023, 12:55pm UTC](https://community.auth0.com/t/apple-storekit-2-x5c-certificate-expired-jwt-io-still-verifies-successfully/117021/3 "2023-09-27T12:55:36Z")

</div>

Hi @betaphi,

Welcome to the Auth0 Community!

I would expect [JWT.io](http://JWT.io) to be correct and not indicate a valid token signature/certificate if it was expired.

Can you share some steps to reproduce?

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [October 26, 2023, 2:23pm UTC](https://community.auth0.com/t/apple-storekit-2-x5c-certificate-expired-jwt-io-still-verifies-successfully/117021/4 "2023-10-26T14:23:31Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.