Hello, since upgrading to version 5.8.0 I am getting an error for my Sectigo renewals. Let me know if you need any additional information. Tee log file is at the bottom.
certbot --version
certbot 5.8.0 - auto upgraded on 2026-09-01
Tested 5.9.0.dev0 (rev 5906) - same error
Snap version
snap version
snap 2.76-0.el8
snapd 2.76-0.el8
series 16
rhel 8.10
kernel 4.18.0-553.144.1.el8_10.x86_64
Cryptography version
/snap/certbot/current/bin/python3 -c "import cryptography; print(cryptography.version)"
50.0.0
Conf file
cat /etc/letsencrypt/renewal/edc04infappd002.chw.edu.conf
version = 5.2.2
archive_dir = /etc/letsencrypt/archive/edc04infappd002.chw.edu
cert = /etc/letsencrypt/live/edc04infappd002.chw.edu/cert.pem
privkey = /etc/letsencrypt/live/edc04infappd002.chw.edu/privkey.pem
chain = /etc/letsencrypt/live/edc04infappd002.chw.edu/chain.pem
fullchain = /etc/letsencrypt/live/edc04infappd002.chw.edu/fullchain.pem
[renewalparams]
account = REDACTED
server = https://acme.sectigo.com/v2/OV
authenticator = standalone
key_type = ecdsa
[acme_renewal_info]
ari_retry_after = 2026-09-09T09:41:02
OS Version
cat /etc/os-release | grep -E "^NAME|^VERSION"
NAME="Red Hat Enterprise Linux"
VERSION="8.10 (Ootpa)"
VERSION_ID="8.10"
OCSP Raw Response
openssl x509 -in /etc/letsencrypt/live/edc04infappd002.chw.edu/cert.pem -noout -ocsp_uri
http://ocsp.sectigo.com
openssl ocsp
-issuer /etc/letsencrypt/live/edc04infappd002.chw.edu/chain.pem
-cert /etc/letsencrypt/live/edc04infappd002.chw.edu/cert.pem
-url $(openssl x509 -in /etc/letsencrypt/live/edc04infappd002.chw.edu/cert.pem -noout -ocsp_uri)
-resp_text 2>&1 | head -50
WARNING: no nonce in response
Response verify OK
OCSP Response Data:
OCSP Response Status: successful (0x0)
Response Type: Basic OCSP Response
Version: 1 (0x0)
Responder Id: 4C387A25346BFDF98F1A601C9271AA67F98237EB
Produced At: Sep 8 21:26:58 2026 GMT
Responses:
Certificate ID:
Hash Algorithm: sha1
Issuer Name Hash: E7A3EDCADB9E2E7728A8AEE18C17F211E305DAD5
Issuer Key Hash: 4C387A25346BFDF98F1A601C9271AA67F98237EB
Serial Number: 501E9DC1FBCBB56ABFAD923C65E9C125
Cert Status: good
This Update: Sep 8 21:26:58 2026 GMT
Next Update: Sep 15 21:26:57 2026 GMT
Signature Algorithm: ecdsa-with-SHA256
30:44:02:20:21:3a:5a:a2:78:13:78:c2:76:02:12:ca:4a:e9:
71:06:58:72:73:35:9a:83:6c:ad:47:18:6b:98:53:0c:d5:09:
02:20:3b:e9:8c:b4:e2:2e:49:80:5f:e6:7f:45:27:fc:28:c1:
cf:64:5b:b1:70:e2:98:e4:fe:04:a0:1e:4e:f7:25:37
/etc/letsencrypt/live/edc04infappd002.chw.edu/cert.pem: good
This Update: Sep 8 21:26:58 2026 GMT
Next Update: Sep 15 21:26:57 2026 GMT
Error Log
2026-09-09 10:21:14,181:DEBUG:urllib3.connectionpool:http://localhost:None "GET /v2/connections?snap=certbot&interface=content HTTP/1.1" 200 97
2026-09-09 10:21:14,326:DEBUG:certbot._internal.main:certbot version: 5.8.0
2026-09-09 10:21:14,326:DEBUG:certbot._internal.main:Location of certbot entry point: /snap/certbot/5893/bin/certbot
2026-09-09 10:21:14,326:DEBUG:certbot._internal.main:Arguments: ['--preconfigured-renewal']
2026-09-09 10:21:14,327:DEBUG:certbot._internal.main:Discovered plugins: PluginsRegistry(PluginEntryPoint#apache,PluginEntryPoint#manual,PluginEntryPoint#nginx,PluginEntryPoint#null,PluginEntryPoint#standalone,PluginEntryPoint#webroot)
2026-09-09 10:21:14,346:DEBUG:certbot._internal.log:Root logging level set at 30
2026-09-09 10:21:14,353:DEBUG:urllib3.connectionpool:Starting new HTTP connection (1): ocsp.sectigo.com:80
2026-09-09 10:21:24,414:DEBUG:urllib3.connectionpool:http://ocsp.sectigo.com:80 "POST / HTTP/1.1" 200 280
2026-09-09 10:21:24,416:DEBUG:certbot._internal.log:Exiting abnormally:
Traceback (most recent call last):
File "/snap/certbot/5893/bin/certbot", line 6, in
sys.exit(main())
^^^^^^
File "/var/lib/snapd/snap/certbot/5893/lib/python3.12/site-packages/certbot/main.py", line 18, in main
return internal_main.main(cli_args)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/var/lib/snapd/snap/certbot/5893/lib/python3.12/site-packages/certbot/_internal/main.py", line 1889, in main
return config.func(config, plugins)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/var/lib/snapd/snap/certbot/5893/lib/python3.12/site-packages/certbot/_internal/main.py", line 1338, in certificates
cert_manager.certificates(config)
File "/var/lib/snapd/snap/certbot/5893/lib/python3.12/site-packages/certbot/_internal/cert_manager.py", line 50, in certificates
_describe_certs(config, parsed_certs, parse_failures)
File "/var/lib/snapd/snap/certbot/5893/lib/python3.12/site-packages/certbot/_internal/cert_manager.py", line 365, in _describe_certs
notify(_report_human_readable(config, parsed_certs))
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/var/lib/snapd/snap/certbot/5893/lib/python3.12/site-packages/certbot/_internal/cert_manager.py", line 343, in _report_human_readable
cert_info = human_readable_cert_info(config, cert)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/var/lib/snapd/snap/certbot/5893/lib/python3.12/site-packages/certbot/_internal/cert_manager.py", line 268, in human_readable_cert_info
elif checker.ocsp_revoked(cert):
^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/var/lib/snapd/snap/certbot/5893/lib/python3.12/site-packages/certbot/_internal/ocsp.py", line 36, in ocsp_revoked
return self.ocsp_revoked_by_paths(cert.cert_path, cert.chain_path)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/var/lib/snapd/snap/certbot/5893/lib/python3.12/site-packages/certbot/_internal/ocsp.py", line 60, in ocsp_revoked_by_paths
return _check_ocsp_cryptography(cert_path, chain_path, url, timeout)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/var/lib/snapd/snap/certbot/5893/lib/python3.12/site-packages/certbot/_internal/ocsp.py", line 114, in _check_ocsp_cryptography
response_ocsp = ocsp.load_der_ocsp_response(response.content)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
ValueError: error parsing asn1 value: ParseError { kind: ExtraData, location: ["OCSPResponse::response_bytes", "ResponseBytes::response", "BasicOCSPResponse::signature_algorithm"] }
2026-09-09 10:21:24,418:ERROR:certbot._internal.log:An unexpected error occurred:
2026-09-09 10:21:24,419:ERROR:certbot._internal.log:ValueError: error parsing asn1 value: ParseError { kind: ExtraData, location: ["OCSPResponse::response_bytes", "ResponseBytes::response", "BasicOCSPResponse::signature_algorithm"] }
Additional finding:
All affected certs use:
Unaffected certs use:
I have OS versions RHEL 8.10, RHEL 9.8 and Ubuntu 22.04.5. All running 5.8.0. They are all affected if they have key_type = ecdsa
Unfortunately, we don't have Sectigo certs to test. It seems like you're comfortable installing the dev version -- would you mind double-checking that this is a (new) certbot issue? You can find previous versions of certbot at e.g. GitHub - certbot/certbot at 5.7.x · GitHub; there is a branch created for each previous release with that .x format.
It is new in version 5.8.0
I have tested on 5.7.0 and it works as expected.
Ah, that's not great, thanks for testing that. Do you happen to have the asn1 value that it's failing to parse so we can create a more narrow test to dig in?
./test.sh
# Get the raw OCSP response and save it
echo "**** Get the raw OCSP repsonse"
openssl ocsp \
-issuer /etc/letsencrypt/live/edc04infappd002.chw.edu/chain.pem \
-cert /etc/letsencrypt/live/edc04infappd002.chw.edu/cert.pem \
-url $(openssl x509 -in /etc/letsencrypt/live/edc04infappd002.chw.edu/cert.pem -noout -ocsp_uri) \
-respout /tmp/ocsp_response.der \
-resp_text 2>&1
# Convert DER to base64 for sharing
echo ""
echo "**** convert DER to base64"
base64 /tmp/ocsp_response.der
# Or dump the raw ASN.1 structure
echo ""
echo "**** Dump the raw ASN.1 structure"
openssl asn1parse -in /tmp/ocsp_response.der -inform DER
# Full ASN.1 dump with offsets
echo ""
echo "**** full ASN.1 dump with ofsets"
openssl asn1parse \
-in /tmp/ocsp_response.der \
-inform DER \
-dump 2>&1
Output
**** Get the raw OCSP repsonse
OCSP Response Data:
OCSP Response Status: successful (0x0)
Response Type: Basic OCSP Response
Version: 1 (0x0)
Responder Id: 4C387A25346BFDF98F1A601C9271AA67F98237EB
Produced At: Sep 8 21:26:58 2026 GMT
Responses:
Certificate ID:
Hash Algorithm: sha1
Issuer Name Hash: E7A3EDCADB9E2E7728A8AEE18C17F211E305DAD5
Issuer Key Hash: 4C387A25346BFDF98F1A601C9271AA67F98237EB
Serial Number: 501E9DC1FBCBB56ABFAD923C65E9C125
Cert Status: good
This Update: Sep 8 21:26:58 2026 GMT
Next Update: Sep 15 21:26:57 2026 GMT
Signature Algorithm: ecdsa-with-SHA256
30:44:02:20:21:3a:5a:a2:78:13:78:c2:76:02:12:ca:4a:e9:
71:06:58:72:73:35:9a:83:6c:ad:47:18:6b:98:53:0c:d5:09:
02:20:3b:e9:8c:b4:e2:2e:49:80:5f:e6:7f:45:27:fc:28:c1:
cf:64:5b:b1:70:e2:98:e4:fe:04:a0:1e:4e:f7:25:37
WARNING: no nonce in response
Response verify OK
/etc/letsencrypt/live/edc04infappd002.chw.edu/cert.pem: good
This Update: Sep 8 21:26:58 2026 GMT
Next Update: Sep 15 21:26:57 2026 GMT
**** convert DER to base64
MIIBFAoBAKCCAQ0wggEJBgkrBgEFBQcwAQEEgfswgfgwgZ6iFgQUTDh6JTRr/fmPGmAcknGqZ/mC
N+sYDzIwMjYwOTA4MjEyNjU4WjBzMHEwSTAJBgUrDgMCGgUABBTno+3K254udyioruGMF/IR4wXa
1QQUTDh6JTRr/fmPGmAcknGqZ/mCN+sCEFAencH7y7Vqv62SPGXpwSWAABgPMjAyNjA5MDgyMTI2
NThaoBEYDzIwMjYwOTE1MjEyNjU3WjAMBggqhkjOPQQDAgUAA0cAMEQCICE6WqJ4E3jCdgISykrp
cQZYcnM1moNsrUcYa5hTDNUJAiA76Yy04i5JgF/mf0Un/CjBz2RbsXDimOT+BKAeTvclNw==
**** Dump the raw ASN.1 structure
0:d=0 hl=4 l= 276 cons: SEQUENCE
4:d=1 hl=2 l= 1 prim: ENUMERATED :00
7:d=1 hl=4 l= 269 cons: cont [ 0 ]
11:d=2 hl=4 l= 265 cons: SEQUENCE
15:d=3 hl=2 l= 9 prim: OBJECT :Basic OCSP Response
26:d=3 hl=3 l= 251 prim: OCTET STRING [HEX DUMP]:3081F830819EA21604144C387A25346BFDF98F1A601C9271AA67F98237EB180F32303236303930383231323635385A307330713049300906052B0E03021A05000414E7A3EDCADB9E2E7728A8AEE18C17F211E305DAD504144C387A25346BFDF98F1A601C9271AA67F98237EB0210501E9DC1FBCBB56ABFAD923C65E9C1258000180F32303236303930383231323635385AA011180F32303236303931353231323635375A300C06082A8648CE3D040302050003470030440220213A5AA2781378C2760212CA4AE97106587273359A836CAD47186B98530CD50902203BE98CB4E22E49805FE67F4527FC28C1CF645BB170E298E4FE04A01E4EF72537
**** full ASN.1 dump with ofsets
0:d=0 hl=4 l= 276 cons: SEQUENCE
4:d=1 hl=2 l= 1 prim: ENUMERATED :00
7:d=1 hl=4 l= 269 cons: cont [ 0 ]
11:d=2 hl=4 l= 265 cons: SEQUENCE
15:d=3 hl=2 l= 9 prim: OBJECT :Basic OCSP Response
26:d=3 hl=3 l= 251 prim: OCTET STRING
0000 - 30 81 f8 30 81 9e a2 16-04 14 4c 38 7a 25 34 6b 0..0......L8z%4k
0010 - fd f9 8f 1a 60 1c 92 71-aa 67 f9 82 37 eb 18 0f ....`..q.g..7...
0020 - 32 30 32 36 30 39 30 38-32 31 32 36 35 38 5a 30 20260908212658Z0
0030 - 73 30 71 30 49 30 09 06-05 2b 0e 03 02 1a 05 00 s0q0I0...+......
0040 - 04 14 e7 a3 ed ca db 9e-2e 77 28 a8 ae e1 8c 17 .........w(.....
0050 - f2 11 e3 05 da d5 04 14-4c 38 7a 25 34 6b fd f9 ........L8z%4k..
0060 - 8f 1a 60 1c 92 71 aa 67-f9 82 37 eb 02 10 50 1e ..`..q.g..7...P.
0070 - 9d c1 fb cb b5 6a bf ad-92 3c 65 e9 c1 25 80 00 .....j...<e..%..
0080 - 18 0f 32 30 32 36 30 39-30 38 32 31 32 36 35 38 ..20260908212658
0090 - 5a a0 11 18 0f 32 30 32-36 30 39 31 35 32 31 32 Z....20260915212
00a0 - 36 35 37 5a 30 0c 06 08-2a 86 48 ce 3d 04 03 02 657Z0...*.H.=...
00b0 - 05 00 03 47 00 30 44 02-20 21 3a 5a a2 78 13 78 ...G.0D. !:Z.x.x
00c0 - c2 76 02 12 ca 4a e9 71-06 58 72 73 35 9a 83 6c .v...J.q.Xrs5..l
00d0 - ad 47 18 6b 98 53 0c d5-09 02 20 3b e9 8c b4 e2 .G.k.S.... ;....
00e0 - 2e 49 80 5f e6 7f 45 27-fc 28 c1 cf 64 5b b1 70 .I._..E'.(..d[.p
00f0 - e2 98 e4 fe 04 a0 1e 4e-f7 25 37 .......N.%7
Looks like cryptography has had some recent changes that more accurately parse asn1 values according to specs, so if sectigo has a malformed response it may have previously been passing when it shouldn't have. Do you have a good way to contact sectigo?
I will reach out to my Security Team contact. He is OOO today but will be back tomorrow.
Happy to help with testing Sectigo in the future if you need me to. All of our certs are renewed via Sectigo. I have test servers I can use for testing.
Actually, would you be willing to live on the nightly builds snapcraft channel? That could help catch errors earlier, since we have tried to set up a sectigo integration testing solution in the past but it fell through since there didn't seem to be a great way to do it. Though that would only help for some queries like ARI, not actual renewals necessarily.
Still working to try to track down the issue from our side as well of course!
I could try to do this on one of my test servers. I wouldn't want to do it on any other server.
I'm not sure how to switch to the nightly builds snapcraft channel. Currently I'm getting snap via the EPEL repo.
Ok so it actually looks like the error is coming from the asn1 crate trying to parse the ocsp response, which is upstream of cryptography, which seems even more like a sectigo issue.
You can switch to the nightly channel by running sudo snap install --classic certbot --channel=latest/edge
Sectigo Case Number:
04300100
FYI, issuing new ecdsa certificates works. No errors.
I did additional testing yesterday.
sudo certbot renew --force-renewal
Looks like this works as expected and renews the certificate. I used --force-renewal because the SuggestedWindow was
{
"suggestedWindow": {
"start": "2026-09-16T23:59:59Z",
"end": "2026-09-18T23:59:59Z"
}
}
The only thing that is not working is
**certbot certificates**
Saving debug log to /var/log/letsencrypt/letsencrypt.log
An unexpected error occurred:
ValueError: error parsing asn1 value: ParseError { kind: ExtraData, location: ["OCSPResponse::response_bytes", "ResponseBytes::response", "BasicOCSPResponse::signature_algorithm"] }
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.
We ran into the same issue around the OCSP and I have a code fix, but I'm unable to do the flows to submit it to the certbot project.
The issue is
├─ signatureAlgorithm
│ ├─ algorithm: ecdsa-with-SHA256
│ │ └─ OID 1.2.840.10045.4.3.2
│ └─ parameters: NULL
Sectigo is returning a parameters: NULL when the algorithm is ecdsa-with-* which breaks the RFC 5758 Section 3.2 directions, where there should be no parameters value with the ECDSA.
It seems openssl doesn't care, but the updated cryptographic library version in Python3 bundled with Certbot 5.8.0 DOES care.
in certbot/src/certbot/_internal/ocsp.py, line number 114 is the issue:
response_ocsp = ocsp.load_der_ocsp_response(response.content)
It's not wrapped in a try: except: like most other ocsp calls, and when the Python3 RUST cryptographic library sees the invalid ASN.1 entry, it throws an error causing the OCSP error, such as with 'certbot certificates'
Saving debug log to /var/log/letsencrypt/letsencrypt.log
An unexpected error occurred:
ValueError: error parsing asn1 value: ParseError { kind: ExtraData, location: ["OCSPResponse::response_bytes", "ResponseBytes::response", "BasicOCSPResponse::signature_algorithm"] }
Adjusting line 114 to something like:
try:
response_ocsp = ocsp.load_der_ocsp_response(response.content)
except ValueError as e:
logger.warning(
"OCSP response for %s could not be parsed (likely a non-RFC-5758 "
"compliant encoding from the responder): %s", cert_path, e
)
return False
will instead return:
Saving debug log to /var/log/letsencrypt/letsencrypt.log
OCSP response for /etc/letsencrypt/live/testing.example.org/cert.pem could not be parsed (likely a non-RFC-5758 compliant encoding from the responder): error parsing asn1 value: ParseError { kind: ExtraData, location: ["OCSPResponse::response_bytes", "ResponseBytes::response", "BasicOCSPResponse::signature_algorithm"] }
Found the following certs:
Certificate Name: testing.example.org
Serial Number: d584cebffffffffffff344b5b21794939
Key Type: ECDSA
Identifiers: testing.example.org
Expiry Date: 2026-10-28 23:59:59+00:00 (VALID: 47 days)
Certificate Path: /etc/letsencrypt/live/testing.example.org/fullchain.pem
Private Key Path: /etc/letsencrypt/live/testing.example.org/privkey.pem
I did make this adjustment locally to my snap installed 5.8.0 client version and that provided the above working result instead of the interrupted response.
We've submitted a ticket to Sectigo around this so they can fix their ocsp.secitgo.com to meet RFC 5758 in terms of the 05 00 (parameters) value in relation to the ECDSA certificates