I have been using letsencrypt certificates for an API server for a while and all has been working fine so far. However since the last certificate update (Nov 13), old Android clients can no longer access the site. After some debugging I just found that the certificate chain no longer includes ISRG R…

Please update to their latest version: VER=3.0.7

Hi @guillerodriguez , and welcome to the LE community forum :slight_smile: What ACME client [and version] are you using? What was the command last used to renew a cert with such a problem? What is a domain name that now shows this problem?

Hi @rg305 I am using acme.sh, version 3.0.0. The command used to renew was acme.sh --renew -d <domain_name> I have a couple of domains with the same setup, I just took one of them which had been renewed on Oct 29 and was still working properly (certificate chain included the ISRG Root X1 intermed…

Why? any info on why would that fix the issue? It seems strange that all has been working fine with 3.0.0 so far and since a few days ago, after what seems to be a change in LE, I suddenly need to update something on the client-side.

I'm not sure if that would fix the problem. [but it would, at least, patch a known security issue] That, and I can only test using v3.0.5 & v3.0.7 and both of those return 3 certs in the fullchain.cer file.

To be clear it included: [image]

[image] Shortening the Let's Encrypt Chain of Trust API Announcements S… there was some mistake at that day enabled new default chain too early.

Hi @orangepizza , This would certainly explain what happened with the system were certs were renewed in Nov 13 and where I started seeing the problem. The strange thing however is that I had another system which had renewed certs in Oct 29 and which was working properly. I force renewed certs on th…

@rg305 I upgraded to 3.0.7, renewed certs, now all is good. I don't quite understand why this works, though. The temporary misconfiguration mentioned here ( Shortening the Let's Encrypt Chain of Trust - #2 by aarongable ) would explain the problem I was originally seen, but I don't understand why af…

Certificate chain no longer includes ISRG Root X1?

Help

orangepizza November 24, 2023, 10:39am 8

there was some mistake at that day enabled new default chain too early.

Topic		Replies	Views
No more ISRG Root X1 in my pem? Help	16	1550	November 15, 2023
Lets encrypt 15th May DST Root CA X3 Help	9	967	March 15, 2024
Connection is not private on Android Chrome Help	6	4155	August 31, 2021
Certificate chain stopped working on older android devices Help	5	772	August 18, 2021
Chain has the wrong root certificate (update: no it doesn't) Help	3	516	September 14, 2023

Certificate chain no longer includes ISRG Root X1?

Related topics