Since 2018-01-12 (about half a year as I write this), the certificate for news.gmane.org has been expired.
% gnutls-cli --crlf news.gmane.org -p nntps <<<QUIT
Processed 148 CA certificate(s).
Resolving 'news.gmane.org:nntps'...
Connecting to '195.159.176.226:563'...
- Certificate type: X.509
- Got a certificate list of 1 certificates.
- Certificate[0] info:
- subject `CN=news.gmane.org,O=Gmane,ST=Some-State,C=NO', issuer `CN=news.gmane.org,O=Gmane,ST=Some-State,C=NO', serial 0x009398630d3ab6ffd6, RSA key 1024 bits, signed using RSA-SHA1, activated `2015-01-13 21:13:46 UTC', expires `2018-01-12 21:13:46 UTC', pin-sha256="V/d+/hePkSL5MylBGzvZ/c21qMz+E9H1SfyP1NKBr1Y="
Public Key ID:
sha1:d21a01452b5a9b06106946930e64717869ff7ae0
sha256:57f77efe178f9122f93329411b3bd9fdcdb5a8ccfe13d1f549fc8fd4d281af56
Public Key PIN:
pin-sha256:V/d+/hePkSL5MylBGzvZ/c21qMz+E9H1SfyP1NKBr1Y=
Public key's random art:
+--[ RSA 1024]----+
|=O+.ooo |
|+*o+ . . |
|= + + o |
| . + = o |
| . + + S |
| . . = |
| . + |
| E . |
| . |
+-----------------+
- Status: The certificate is NOT trusted. The certificate issuer is unknown. The certificate chain uses expired certificate.
*** PKI verification of server certificate failed...
*** Fatal error: Error in the certificate.
*** handshake has failed: Error in the certificate.
January 2018 is after you posed this question, but this (less than ideal) workaround still applies: do not connect to Gmane with a secure connection.
(setq gnus-select-method
'(nntp "news.gmane.org"
(nntp-open-connection-function nntp-open-plain-stream)))