As this is the only mention of how this Root certificate expiry affects enketo, thought to share what ultimately solved it for me. As per this SO answer, the root certificates are hardcoded in the nodejs source code, so it won’t use these from the OS unless the node process is started with the --use-openssl-ca flag. Quick, dirty, and dangerous fix is to set the NODE_TLS_REJECT_UNAUTHORIZED environment variable to 0
