OpenSSL TLS 1.2 session resumption accepts expired server certificates in libcurl

curl's OpenSSL backend can accept a new TLS 1.2 HTTPS connection after the server certificate has expired if the connection resumes a previously cached TLS session. A full handshake made at the same time with the same certificate fails with `CURLE_PEER_FAILED_VERIFICATION`, but the resumed …

bash <<'EOF'
set -euo pipefail
CURL_BIN="${CURL_BIN:-curl}"

command -v "$CURL_BIN" >/dev/null 2>&1 || {
  echo "missing curl binary: $CURL_BIN" >&2
  exit 1
}
command -v python3 >/dev/null 2>&1 || {
  echo "missing required command: python3" >&2
  exit 1
}

python3 - <<'PY'
try:
    import …