Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.
It produced this output:acme-client: /etc/ssl/freakalicious.us:443.crt: certificate renewable: -11 days left
acme-client: https://acme-v02.api.letsencrypt.org/directory: directories
acme-client: acme-v02.api.letsencrypt.org: DNS: 172.65.32.248
acme-client: 172.65.32.248: tls_write: certificate verification failed: unable to get local issuer certificate
acme-client: 172.65.32.248: tls_read: handshake failed: error:14FFF086:SSL routines:(UNKNOWN)SSL_internal:certificate verify failed
acme-client: https://acme-v02.api.letsencrypt.org/directory: bad comm
acme-client: bad exit: netproc(39614): 1
My web server is (include version): openBSD httpd
The operating system my web server runs on is (include version): openBSD 7.4
My hosting provider, if applicable, is: Vultr
I can login to a root shell on my machine (yes or no, or I don't know): yes
I'm using a control panel to manage my site (no, or provide the name and version of the control panel): no
The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): not using certbot
SSL certificate problem: unable to get local issuer certificate
Closing connection
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: curl - SSL CA Certificates
curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.
Console output is easier to read if you place it between two lines that contain only the backticks like this:
```
Your console output here
And here
```
It will format as follows:
Your console output here
And here
The smaller size of your root certificate store suggests that you may be missing vital trusted root CAs. My /etc/ssl/cert.pem is the same size as the one found by @Bruce5051. I'm also on OpenBSD 7.5. You might want to compare your /etc/ssl/cert.pem against another from an official source.
The date of your last successful cert was May 3 at 3:11, which happens to match the date shown for your cert.pem in your root store. Looks like you overlaid your root store with something from that.
That cert + the R3 PEM file are together 4046 bytes. Probably one byte extra for a blank line or something like that makes 4047.
Looks like someone overwrote the root store with fullchain.pem from acme-client (or however the full chain from the ACME server is called in that client).
You need to fix your systems root certificate store first, which is why you can't even connect to the Let's Encrypt ACME server. And most likely any other HTTPS website to begin with from that system.
The original OpenBSD cert.pem root certificate store file is already linked above in the thread.
