Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com ), so withholding your domain name here does not increase secrecy, but …

Supplemental information to assist community volunteers and others acme-client(1) - OpenBSD manual pages acme-client.conf(5) - OpenBSD manual pages httpd(8) - OpenBSD manual pages httpd.conf(5) - OpenBSD manual pages Also see this thread Acme-client bad comm cert verify failed Edit Are the Date…

Welcome to the community @tfrendberg Looks like a problem verifying the cert used by the Let's Encrypt API. Would you show output of this? curl -v https://acme-v02.api.letsencrypt.org/directory

More supplemental information The expired certificate being served does not supply a full chain [image]

[image] MikeMcQ: curl -v https://acme-v02.api.letsencrypt.org/directory Host acme-v02.api.letsencrypt.org:443 was resolved. IPv6: 2606:4700:60:0:f53d:5624:85c7:3a2c IPv4: 172.65.32.248 Trying 172.65.32.248:443... Connected to acme-v02.api.letsencrypt.org (172.65.32.248) port 443 ALPN: curl o…

▶ I see this with my OpenBSD 7.5

@tfrendberg What does this show sudo ls -l /etc/ssl/cert.pem @Bruce5051 Same question for you :slight_smile: And @tfrendberg this additional command just for you echo | openssl s_client -connect acme-v02.api.letsencrypt.org:443 | head

[image] MikeMcQ: Same question for you :slight_smile: $ ls -l /etc/ssl/cert.pem -r--r--r-- 1 root bin 348925 Apr 8 17:54 /etc/ssl/cert.pem

freakalicious# ls -l /etc/ssl/cert.pem -r--r--r-- 1 root wheel 4047 May 3 03:11 /etc/ssl/cert.pem freakalicious# echo | openssl s_client -connect acme-v02.api.letsencrypt.org:443 | head depth=1 CN = acme-v02.api.letsencrypt.org verify error:num=20:unable to get local issuer certificate verify r…

Console output is easier to read if you place it between two lines that contain only the backticks like this: ``` Your console output here And here ``` It will format as follows: Your console output here And here The smaller size of your root certificate store suggests that you may be missing…

Bad com renewing certificate

Help

Bruce5051 August 13, 2024, 1:46am 2

Supplemental information to assist community volunteers and others

acme-client(1) - OpenBSD manual pages
acme-client.conf(5) - OpenBSD manual pages
httpd(8) - OpenBSD manual pages
httpd.conf(5) - OpenBSD manual pages

Also see this thread Acme-client bad comm cert verify failed

Edit

Are the Date and Time correct on the system?

And this https://daemonforums.org/showthread.php?t=11987

Topic		Replies	Views
Acme-client bad comm cert verify failed Help	32	935	September 5, 2024
Certificate Expiration Help	34	1300	December 15, 2023
[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed Help	11	5648	February 20, 2022
Problem renewing certificate (OpenBSD 6.7, httpd + acme-client) Help	3	811	April 8, 2021
Problem with certificate has expired Help	28	25745	November 5, 2021

Bad com renewing certificate

Are the Date and Time correct on the system?

Related topics