Attempting to renew cert: unexpected error: bad handshake

Welcome to the community @YuGiOhJCJ

At the end of Sept a root certificate for Let's Encrypt expired. There are numerous posts on this topic. As part of addressing that the certificate chain sent by Let's Encrypt for its ACME server changed. It now uses what we are call the "short chain" which terminates in a cert called ISRG Root X1. Clients, like certbot, need to be able to validate that chain.

You have a few options:

  1. Update your CA Certificate store to include ISRG Root X1. I am not at all familiar with your os version so cannot advise specifics.
  2. Use a different CA to issue your certificates

As to option 1, see this thread for possible ways to do that on slackware 14.1. Perhaps ask the slackware community about it. If you do find a way to install ISRG Root X1 please post back to help future readers of this forum.

If that does not work and a different CA is not viable you could, as a last resort, have certbot ignore the security checks on the cert chain from the LE server. You do this by adding --no-verify-ssl to the command line. If you choose this option you should take care to validate the certificates you receive just to be sure they are legit.

3 Likes