Certificate errors EVERYWHERE!

Help
1

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: nummer378.de

I ran this command: openssl s_client -connect nummer378.de:443 -showcerts

It produced this output:

CONNECTED(000001A4)
depth=1 CN = R3, O = Let's Encrypt, C = US
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 CN = nummer378.de
verify return:1
---
Certificate chain
 0 s:CN = nummer378.de
   i:CN = R3, O = Let's Encrypt, C = US
   a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256
   v:NotBefore: Apr  1 08:17:16 2023 GMT; NotAfter: Jun 30 08:17:15 2023 GMT
-----BEGIN CERTIFICATE-----
MIIEFjCCAv6gAwIBAgIPPSBhcHJpbCBmb29scyA9MA0GCSqGSIb3DQEBCwUAMDIx
CzAJBgNVBAMMAlIzMRYwFAYDVQQKDA1MZXQncyBFbmNyeXB0MQswCQYDVQQGDAJV
UzAeFw0yMzA0MDEwODE3MTZaFw0yMzA2MzAwODE3MTVaMBcxFTATBgNVBAMMDG51
bW1lcjM3OC5kZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALk8AakO
VA7/IbFs3mVemtoNSZIXQZqgNocTdxy7rprycwm3K9zhVfkryRSPHwBYS8sO6lFy
+j0epla3TKMkeqke4uUP1V4nXPvnVOecNKY4edHUQtgvSCn00Nmi5jp46pkzSg+l
BGuIEQAPVhx27XwrvHZssiX8FBwuK0XZ9x/QPTtja61Gutn3ekjJYEaWEqOcHbCv
HzF6oKR0rqnaEAi34cDDJvHnzyEXw9KRAncHn04h3Hy9kvXE5AV6LTHxhXVo+Tu9
PQG73aGQ2p/9DQ3+hlnCZjuU2LkwUnkTO0KhvNdrXwoEgw3KGwYq+MopDYBjegCV
Ph5GjeeVa5AFSLUCAwEAAaOCAUIwggE+MB8GA1UdIwQYMBaAFJrBA/R7ycax/9RD
QZf0IrryWO5dMBcGA1UdEQQQMA6CDG51bW1lcjM3OC5kZTAOBgNVHQ8BAf8EBAMC
BaAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMB0GA1UdDgQWBBTR+pAL
yNZCLsPPnmWVVWdKIsWVbTAPBgNVHRMBAf8EBTADAQEAMEwGA1UdIARFMEMwCAYG
Z4EMAQIBMDcGCysGAQQBgt8TAQEBMCgwJgYIKwYBBQUHAgEWGmh0dHA6Ly9jcHMu
bGV0c2VuY3J5cHQub3JnMFUGCCsGAQUFBwEBBEkwRzAhBggrBgEFBQcwAYYVaHR0
cDovL3IzLm8ubGVuY3Iub3JnMCIGCCsGAQUFBzAChhZodHRwOi8vcjMuaS5sZW5j
ci5vcmcvMA0GCSqGSIb3DQEBCwUAA4IBAQDGYuJic9jsWKjFZSban1yU3L85jbv/
VsX9aWPE3aPIWhoI1hFF73dJN2oOeoy2mGmpjbO4e2a1OGZzXxIaMZt74df7fOtf
L59dTj64bM2j7HS4dDx/dHnDDMQITD99oF398enemqfk1UZwDr2QwtlCHU015JE4
f6s9dHA+/jemIl29WtxsVgCQTbN0FqZijiYvfZpt73p6e4bCr7V+GOG/UDkX/07/
rBxH1pC6Zm5Zf3ufNjBgu4LueV+/4w5Rv2q/do8zahuHxw/da5/33D0DVZNFSHQl
4PiB2IdIRm9xdVqFa8gUUAs/Ui5kdWVDHzN7q3Tr3E5l50V7VHMxfwNZ
-----END CERTIFICATE-----
 1 s:CN = R3, O = Let's Encrypt, C = US
   i:CN = ISRG Root X1, O = Internet Security Research Group, C = US
   a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256
   v:NotBefore: Sep  4 00:00:00 2020 GMT; NotAfter: Sep 15 16:00:00 2025 GMT
-----BEGIN CERTIFICATE-----
MIIEkzCCAnugAwIBAgIRANMJopTmTVe5XsmXtIRP9ZswDQYJKoZIhvcNAQELBQAw
TzEVMBMGA1UEAwwMSVNSRyBSb290IFgxMSkwJwYDVQQKDCBJbnRlcm5ldCBTZWN1
cml0eSBSZXNlYXJjaCBHcm91cDELMAkGA1UEBgwCVVMwHhcNMjAwOTA0MDAwMDAw
WhcNMjUwOTE1MTYwMDAwWjAyMQswCQYDVQQDDAJSMzEWMBQGA1UECgwNTGV0J3Mg
RW5jcnlwdDELMAkGA1UEBgwCVVMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
AoIBAQDvRvtY92Mpr9fO4TMw/hi+Hn2cU6/cGiwSw1idc7pYpNtgo2QyFtaTi5vr
iAmMJ1lVMQIimYGtaM6qgR1I+j8qLgQLFAwo4hs4IqL9luFIbSQqIMfuFn4gJ9ks
0MDL66i36jQ5NPtLmtYAOzP52g3dpab6N67dyKLbur9YhFCsKGM2c3GWspMl34V3
H/rdtQOUIXUhIWBrXnDnYk2OEukO6fQPdap5DJRMJFUmhGGBf2JuoAqjhfnB8XsQ
msoKlml8Jlz5LWNLcnYQ1pJUf6AFqYV/5NBEUlo3KIX1xqfzYBJU0kjUfGnOgSCd
R2G5dGaPcVWRMFJM0PSHaDTcuSv1AgMBAAGjgYYwgYMwHwYDVR0jBBgwFoAUtBgU
m9frFhmbIJV0icg72wBqviwwDgYDVR0PAQH/BAQDAgGGMB0GA1UdJQQWMBQGCCsG
AQUFBwMCBggrBgEFBQcDATAdBgNVHQ4EFgQUmsED9HvJxrH/1ENBl/QiuvJY7l0w
EgYDVR0TAQH/BAgwBgEB/wIBADANBgkqhkiG9w0BAQsFAAOCAgEAV/AJt3f5JN1C
nNcXH9aTuv2C+WJZa7/d9QxIePdiNP/KB3QFQ5aWKunENijqZ9akji76gx7QTH/+
5GOaG1+je2tGULj/22wEcoYpzC9Ny+dDGrzljzK2dfbnK825TG+0O25t4NEfg2yl
ewUbJwJm8EoI+1eOfMlQUD1WXoAQujLJx0KSNslRiMyz41rH0ZI59NlU51wqEiF6
5siInOciHSoXk0yWybSwD71RWK4Lw+B2HleB3jKGbEW/xoHegrJvZjabbKYljIyl
94cN3HSU1m164i8YCpyE6ZHrClIH9618pJRAstapllHD92FbD6Rns/5mSbTHrSzq
D5iQKCuNpu9eKN5s/eN06CJ9BX7n/WF1Up9BZ73sLJcvjkRWcAq9BqzFttKiNnyk
5MB4PSe4hbDqUc12fq4xdt6vG/FKLKuoHKdQnMn7Yg6GY3QTbgBepqBQFapkly/o
cFXto11agbtmkBP7pWO5nvNEocYQJ2IHldEorMD1SgRvN5xvbvDPCjZDued2vtaW
mdXNYrdecmQi2IKPX8xLl83RbCLDdXDHT8T69OtuFDVV96dBxd96i86Gqo1yuETl
FU+ydp8tFBUMAVi2UwSXO4zLrzX/u5oKWr9OQ6DeoEvHr7W2klgz1I77R9CeLgk6
U4NkxNzL/jskdQ8D7CC1+3eN4y+zURI=
-----END CERTIFICATE-----
---
Server certificate
subject=CN = nummer378.de
issuer=CN = R3, O = Let's Encrypt, C = US
---

My web server is (include version): CERN httpd. Don't know about the version, haven't updated in a while.

The operating system my web server runs on is (include version): Debian Lenny

My hosting provider, if applicable, is: Hetzner

I can login to a root shell on my machine (yes or no, or I don't know): Only during working hours

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): No

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): I don't use a client for security reasons. I use curl.

So, I updated my certificates last night - manually like I always do, because I hate automation - and now it's broken on all clients!!! I tried like everything and it doesn't work!

  • With Firefox I get SEC_ERROR_UNKNOWN_ISSUER
  • Chrome says NET::ERR_CERT_AUTHORITY_INVALID
  • OpenSSL reports unable to get local issuer certificate
  • Windows (schannel) errors with SEC_E_UNTRUSTED_ROOT

I do believe I have ISRG Root X1 installed, at least this used to work??? This domain has been running fine for years, but now I get this error on all of my machines?

The certificate looks fine, so I don't know what the problem is:

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            3d:20:61:70:72:69:6c:20:66:6f:6f:6c:73:20:3d
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN = R3, O = Let's Encrypt, C = US
        Validity
            Not Before: Apr  1 08:17:16 2023 GMT
            Not After : Jun 30 08:17:15 2023 GMT
        Subject: CN = nummer378.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:b9:3c:01:a9:0e:54:0e:ff:21:b1:6c:de:65:5e:
                    9a:da:0d:49:92:17:41:9a:a0:36:87:13:77:1c:bb:
                    ae:9a:f2:73:09:b7:2b:dc:e1:55:f9:2b:c9:14:8f:
                    1f:00:58:4b:cb:0e:ea:51:72:fa:3d:1e:a6:56:b7:
                    4c:a3:24:7a:a9:1e:e2:e5:0f:d5:5e:27:5c:fb:e7:
                    54:e7:9c:34:a6:38:79:d1:d4:42:d8:2f:48:29:f4:
                    d0:d9:a2:e6:3a:78:ea:99:33:4a:0f:a5:04:6b:88:
                    11:00:0f:56:1c:76:ed:7c:2b:bc:76:6c:b2:25:fc:
                    14:1c:2e:2b:45:d9:f7:1f:d0:3d:3b:63:6b:ad:46:
                    ba:d9:f7:7a:48:c9:60:46:96:12:a3:9c:1d:b0:af:
                    1f:31:7a:a0:a4:74:ae:a9:da:10:08:b7:e1:c0:c3:
                    26:f1:e7:cf:21:17:c3:d2:91:02:77:07:9f:4e:21:
                    dc:7c:bd:92:f5:c4:e4:05:7a:2d:31:f1:85:75:68:
                    f9:3b:bd:3d:01:bb:dd:a1:90:da:9f:fd:0d:0d:fe:
                    86:59:c2:66:3b:94:d8:b9:30:52:79:13:3b:42:a1:
                    bc:d7:6b:5f:0a:04:83:0d:ca:1b:06:2a:f8:ca:29:
                    0d:80:63:7a:00:95:3e:1e:46:8d:e7:95:6b:90:05:
                    48:b5
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                9A:C1:03:F4:7B:C9:C6:B1:FF:D4:43:41:97:F4:22:BA:F2:58:EE:5D
            X509v3 Subject Alternative Name:
                DNS:nummer378.de
            X509v3 Key Usage: critical
                Digital Signature, Key Encipherment
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Subject Key Identifier:
                D1:FA:90:0B:C8:D6:42:2E:C3:CF:9E:65:95:55:67:4A:22:C5:95:6D
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.44947.1.1.1
                  CPS: http://cps.letsencrypt.org
            Authority Information Access:
                OCSP - URI:http://r3.o.lencr.org
                CA Issuers - URI:http://r3.i.lencr.org/
    Signature Algorithm: sha256WithRSAEncryption
    Signature Value:
        c6:62:e2:62:73:d8:ec:58:a8:c5:65:26:da:9f:5c:94:dc:bf:
        39:8d:bb:ff:56:c5:fd:69:63:c4:dd:a3:c8:5a:1a:08:d6:11:
        45:ef:77:49:37:6a:0e:7a:8c:b6:98:69:a9:8d:b3:b8:7b:66:
        b5:38:66:73:5f:12:1a:31:9b:7b:e1:d7:fb:7c:eb:5f:2f:9f:
        5d:4e:3e:b8:6c:cd:a3:ec:74:b8:74:3c:7f:74:79:c3:0c:c4:
        08:4c:3f:7d:a0:5d:fd:f1:e9:de:9a:a7:e4:d5:46:70:0e:bd:
        90:c2:d9:42:1d:4d:35:e4:91:38:7f:ab:3d:74:70:3e:fe:37:
        a6:22:5d:bd:5a:dc:6c:56:00:90:4d:b3:74:16:a6:62:8e:26:
        2f:7d:9a:6d:ef:7a:7a:7b:86:c2:af:b5:7e:18:e1:bf:50:39:
        17:ff:4e:ff:ac:1c:47:d6:90:ba:66:6e:59:7f:7b:9f:36:30:
        60:bb:82:ee:79:5f:bf:e3:0e:51:bf:6a:bf:76:8f:33:6a:1b:
        87:c7:0f:dd:6b:9f:f7:dc:3d:03:55:93:45:48:74:25:e0:f8:
        81:d8:87:48:46:6f:71:75:5a:85:6b:c8:14:50:0b:3f:52:2e:
        64:75:65:43:1f:33:7b:ab:74:eb:dc:4e:65:e7:45:7b:54:73:
        31:7f:03:59

Maybe there's something broken on LE side? Can someone check?

7 Likes
2

that "R3" have different public key?

6 Likes
3

The intermediate R3-signed-by-ISRG Root X1 send by your server is different from the intermediate R3-signed-by-ISRG Root X1 that's present on the chain of trust page for some reason.

This is the intermediate send by your server:

osiris@erazer ~ $ openssl x509 -noout -text <<EOF
> -----BEGIN CERTIFICATE-----
MIIEkzCCAnugAwIBAgIRANMJopTmTVe5XsmXtIRP9ZswDQYJKoZIhvcNAQELBQAw
TzEVMBMGA1UEAwwMSVNSRyBSb290IFgxMSkwJwYDVQQKDCBJbnRlcm5ldCBTZWN1
cml0eSBSZXNlYXJjaCBHcm91cDELMAkGA1UEBgwCVVMwHhcNMjAwOTA0MDAwMDAw
WhcNMjUwOTE1MTYwMDAwWjAyMQswCQYDVQQDDAJSMzEWMBQGA1UECgwNTGV0J3Mg
RW5jcnlwdDELMAkGA1UEBgwCVVMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
AoIBAQDvRvtY92Mpr9fO4TMw/hi+Hn2cU6/cGiwSw1idc7pYpNtgo2QyFtaTi5vr
iAmMJ1lVMQIimYGtaM6qgR1I+j8qLgQLFAwo4hs4IqL9luFIbSQqIMfuFn4gJ9ks
0MDL66i36jQ5NPtLmtYAOzP52g3dpab6N67dyKLbur9YhFCsKGM2c3GWspMl34V3
H/rdtQOUIXUhIWBrXnDnYk2OEukO6fQPdap5DJRMJFUmhGGBf2JuoAqjhfnB8XsQ
msoKlml8Jlz5LWNLcnYQ1pJUf6AFqYV/5NBEUlo3KIX1xqfzYBJU0kjUfGnOgSCd
R2G5dGaPcVWRMFJM0PSHaDTcuSv1AgMBAAGjgYYwgYMwHwYDVR0jBBgwFoAUtBgU
m9frFhmbIJV0icg72wBqviwwDgYDVR0PAQH/BAQDAgGGMB0GA1UdJQQWMBQGCCsG
AQUFBwMCBggrBgEFBQcDATAdBgNVHQ4EFgQUmsED9HvJxrH/1ENBl/QiuvJY7l0w
EgYDVR0TAQH/BAgwBgEB/wIBADANBgkqhkiG9w0BAQsFAAOCAgEAV/AJt3f5JN1C
nNcXH9aTuv2C+WJZa7/d9QxIePdiNP/KB3QFQ5aWKunENijqZ9akji76gx7QTH/+
5GOaG1+je2tGULj/22wEcoYpzC9Ny+dDGrzljzK2dfbnK825TG+0O25t4NEfg2yl
ewUbJwJm8EoI+1eOfMlQUD1WXoAQujLJx0KSNslRiMyz41rH0ZI59NlU51wqEiF6
5siInOciHSoXk0yWybSwD71RWK4Lw+B2HleB3jKGbEW/xoHegrJvZjabbKYljIyl
94cN3HSU1m164i8YCpyE6ZHrClIH9618pJRAstapllHD92FbD6Rns/5mSbTHrSzq
D5iQKCuNpu9eKN5s/eN06CJ9BX7n/WF1Up9BZ73sLJcvjkRWcAq9BqzFttKiNnyk
5MB4PSe4hbDqUc12fq4xdt6vG/FKLKuoHKdQnMn7Yg6GY3QTbgBepqBQFapkly/o
cFXto11agbtmkBP7pWO5nvNEocYQJ2IHldEorMD1SgRvN5xvbvDPCjZDued2vtaW
mdXNYrdecmQi2IKPX8xLl83RbCLDdXDHT8T69OtuFDVV96dBxd96i86Gqo1yuETl
FU+ydp8tFBUMAVi2UwSXO4zLrzX/u5oKWr9OQ6DeoEvHr7W2klgz1I77R9CeLgk6
U4NkxNzL/jskdQ8D7CC1+3eN4y+zURI=
-----END CERTIFICATE-----
EOF
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            d3:09:a2:94:e6:4d:57:b9:5e:c9:97:b4:84:4f:f5:9b
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN = ISRG Root X1, O = Internet Security Research Group, C = US
        Validity
            Not Before: Sep  4 00:00:00 2020 GMT
            Not After : Sep 15 16:00:00 2025 GMT
        Subject: CN = R3, O = Let's Encrypt, C = US
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:ef:46:fb:58:f7:63:29:af:d7:ce:e1:33:30:fe:
                    18:be:1e:7d:9c:53:af:dc:1a:2c:12:c3:58:9d:73:
                    ba:58:a4:db:60:a3:64:32:16:d6:93:8b:9b:eb:88:
                    09:8c:27:59:55:31:02:22:99:81:ad:68:ce:aa:81:
                    1d:48:fa:3f:2a:2e:04:0b:14:0c:28:e2:1b:38:22:
                    a2:fd:96:e1:48:6d:24:2a:20:c7:ee:16:7e:20:27:
                    d9:2c:d0:c0:cb:eb:a8:b7:ea:34:39:34:fb:4b:9a:
                    d6:00:3b:33:f9:da:0d:dd:a5:a6:fa:37:ae:dd:c8:
                    a2:db:ba:bf:58:84:50:ac:28:63:36:73:71:96:b2:
                    93:25:df:85:77:1f:fa:dd:b5:03:94:21:75:21:21:
                    60:6b:5e:70:e7:62:4d:8e:12:e9:0e:e9:f4:0f:75:
                    aa:79:0c:94:4c:24:55:26:84:61:81:7f:62:6e:a0:
                    0a:a3:85:f9:c1:f1:7b:10:9a:ca:0a:96:69:7c:26:
                    5c:f9:2d:63:4b:72:76:10:d6:92:54:7f:a0:05:a9:
                    85:7f:e4:d0:44:52:5a:37:28:85:f5:c6:a7:f3:60:
                    12:54:d2:48:d4:7c:69:ce:81:20:9d:47:61:b9:74:
                    66:8f:71:55:91:30:52:4c:d0:f4:87:68:34:dc:b9:
                    2b:f5
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier: 
                keyid:B4:18:14:9B:D7:EB:16:19:9B:20:95:74:89:C8:3B:DB:00:6A:BE:2C

            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage: 
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 Subject Key Identifier: 
                9A:C1:03:F4:7B:C9:C6:B1:FF:D4:43:41:97:F4:22:BA:F2:58:EE:5D
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: sha256WithRSAEncryption
         57:f0:09:b7:77:f9:24:dd:42:9c:d7:17:1f:d6:93:ba:fd:82:
         f9:62:59:6b:bf:dd:f5:0c:48:78:f7:62:34:ff:ca:07:74:05:
         43:96:96:2a:e9:c4:36:28:ea:67:d6:a4:8e:2e:fa:83:1e:d0:
         4c:7f:fe:e4:63:9a:1b:5f:a3:7b:6b:46:50:b8:ff:db:6c:04:
         72:86:29:cc:2f:4d:cb:e7:43:1a:bc:e5:8f:32:b6:75:f6:e7:
         2b:cd:b9:4c:6f:b4:3b:6e:6d:e0:d1:1f:83:6c:a5:7b:05:1b:
         27:02:66:f0:4a:08:fb:57:8e:7c:c9:50:50:3d:56:5e:80:10:
         ba:32:c9:c7:42:92:36:c9:51:88:cc:b3:e3:5a:c7:d1:92:39:
         f4:d9:54:e7:5c:2a:12:21:7a:e6:c8:88:9c:e7:22:1d:2a:17:
         93:4c:96:c9:b4:b0:0f:bd:51:58:ae:0b:c3:e0:76:1e:57:81:
         de:32:86:6c:45:bf:c6:81:de:82:b2:6f:66:36:9b:6c:a6:25:
         8c:8c:a5:f7:87:0d:dc:74:94:d6:6d:7a:e2:2f:18:0a:9c:84:
         e9:91:eb:0a:52:07:f7:ad:7c:a4:94:40:b2:d6:a9:96:51:c3:
         f7:61:5b:0f:a4:67:b3:fe:66:49:b4:c7:ad:2c:ea:0f:98:90:
         28:2b:8d:a6:ef:5e:28:de:6c:fd:e3:74:e8:22:7d:05:7e:e7:
         fd:61:75:52:9f:41:67:bd:ec:2c:97:2f:8e:44:56:70:0a:bd:
         06:ac:c5:b6:d2:a2:36:7c:a4:e4:c0:78:3d:27:b8:85:b0:ea:
         51:cd:76:7e:ae:31:76:de:af:1b:f1:4a:2c:ab:a8:1c:a7:50:
         9c:c9:fb:62:0e:86:63:74:13:6e:00:5e:a6:a0:50:15:aa:64:
         97:2f:e8:70:55:ed:a3:5d:5a:81:bb:66:90:13:fb:a5:63:b9:
         9e:f3:44:a1:c6:10:27:62:07:95:d1:28:ac:c0:f5:4a:04:6f:
         37:9c:6f:6e:f0:cf:0a:36:43:b9:e7:76:be:d6:96:99:d5:cd:
         62:b7:5e:72:64:22:d8:82:8f:5f:cc:4b:97:cd:d1:6c:22:c3:
         75:70:c7:4f:c4:fa:f4:eb:6e:14:35:55:f7:a7:41:c5:df:7a:
         8b:ce:86:aa:8d:72:b8:44:e5:15:4f:b2:76:9f:2d:14:15:0c:
         01:58:b6:53:04:97:3b:8c:cb:af:35:ff:bb:9a:0a:5a:bf:4e:
         43:a0:de:a0:4b:c7:af:b5:b6:92:58:33:d4:8e:fb:47:d0:9e:
         2e:09:3a:53:83:64:c4:dc:cb:fe:3b:24:75:0f:03:ec:20:b5:
         fb:77:8d:e3:2f:b3:51:12
osiris@erazer ~ $

This is the R3-signed-by-ISRG Root X1 from the chain of trust page:

osiris@erazer ~ $ openssl x509 -noout -text <<EOF
> -----BEGIN CERTIFICATE-----
MIIFFjCCAv6gAwIBAgIRAJErCErPDBinU/bWLiWnX1owDQYJKoZIhvcNAQELBQAw
TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh
cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMjAwOTA0MDAwMDAw
WhcNMjUwOTE1MTYwMDAwWjAyMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3Mg
RW5jcnlwdDELMAkGA1UEAxMCUjMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
AoIBAQC7AhUozPaglNMPEuyNVZLD+ILxmaZ6QoinXSaqtSu5xUyxr45r+XXIo9cP
R5QUVTVXjJ6oojkZ9YI8QqlObvU7wy7bjcCwXPNZOOftz2nwWgsbvsCUJCWH+jdx
sxPnHKzhm+/b5DtFUkWWqcFTzjTIUu61ru2P3mBw4qVUq7ZtDpelQDRrK9O8Zutm
NHz6a4uPVymZ+DAXXbpyb/uBxa3Shlg9F8fnCbvxK/eG3MHacV3URuPMrSXBiLxg
Z3Vms/EY96Jc5lP/Ooi2R6X/ExjqmAl3P51T+c8B5fWmcBcUr2Ok/5mzk53cU6cG
/kiFHaFpriV1uxPMUgP17VGhi9sVAgMBAAGjggEIMIIBBDAOBgNVHQ8BAf8EBAMC
AYYwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMBMBIGA1UdEwEB/wQIMAYB
Af8CAQAwHQYDVR0OBBYEFBQusxe3WFbLrlAJQOYfr52LFMLGMB8GA1UdIwQYMBaA
FHm0WeZ7tuXkAXOACIjIGlj26ZtuMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcw
AoYWaHR0cDovL3gxLmkubGVuY3Iub3JnLzAnBgNVHR8EIDAeMBygGqAYhhZodHRw
Oi8veDEuYy5sZW5jci5vcmcvMCIGA1UdIAQbMBkwCAYGZ4EMAQIBMA0GCysGAQQB
gt8TAQEBMA0GCSqGSIb3DQEBCwUAA4ICAQCFyk5HPqP3hUSFvNVneLKYY611TR6W
PTNlclQtgaDqw+34IL9fzLdwALduO/ZelN7kIJ+m74uyA+eitRY8kc607TkC53wl
ikfmZW4/RvTZ8M6UK+5UzhK8jCdLuMGYL6KvzXGRSgi3yLgjewQtCPkIVz6D2QQz
CkcheAmCJ8MqyJu5zlzyZMjAvnnAT45tRAxekrsu94sQ4egdRCnbWSDtY7kh+BIm
lJNXoB1lBMEKIq4QDUOXoRgffuDghje1WrG9ML+Hbisq/yFOGwXD9RiX8F6sw6W4
avAuvDszue5L3sz85K+EC4Y/wFVDNvZo4TYXao6Z0f+lQKc0t8DQYzk1OXVu8rp2
yJMC6alLbBfODALZvYH7n7do1AZls4I9d1P4jnkDrQoxB3UqQ9hVl3LEKQ73xF1O
yK5GhDDX8oVfGKF5u+decIsH4YaTw7mP3GFxJSqv3+0lUFJoi5Lc5da149p90Ids
hCExroL1+7mryIkXPeFM5TgO9r0rvZaBFOvV2z0gp35Z0+L4WPlbuEjN/lxPFin+
HlUjr8gRsI3qfJOQFy/9rKIJR0Y/8Omwt/8oTWgy1mdeHmmjk7j1nYsvC9JSQ6Zv
MldlTTKB3zhThV1+XWYp6rjd5JW1zbVWEkLNxE7GJThEUG3szgBVGP7pSWTUTsqX
nLRbwHOoq7hHwg==
-----END CERTIFICATE-----
EOF
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            91:2b:08:4a:cf:0c:18:a7:53:f6:d6:2e:25:a7:5f:5a
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = Internet Security Research Group, CN = ISRG Root X1
        Validity
            Not Before: Sep  4 00:00:00 2020 GMT
            Not After : Sep 15 16:00:00 2025 GMT
        Subject: C = US, O = Let's Encrypt, CN = R3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:bb:02:15:28:cc:f6:a0:94:d3:0f:12:ec:8d:55:
                    92:c3:f8:82:f1:99:a6:7a:42:88:a7:5d:26:aa:b5:
                    2b:b9:c5:4c:b1:af:8e:6b:f9:75:c8:a3:d7:0f:47:
                    94:14:55:35:57:8c:9e:a8:a2:39:19:f5:82:3c:42:
                    a9:4e:6e:f5:3b:c3:2e:db:8d:c0:b0:5c:f3:59:38:
                    e7:ed:cf:69:f0:5a:0b:1b:be:c0:94:24:25:87:fa:
                    37:71:b3:13:e7:1c:ac:e1:9b:ef:db:e4:3b:45:52:
                    45:96:a9:c1:53:ce:34:c8:52:ee:b5:ae:ed:8f:de:
                    60:70:e2:a5:54:ab:b6:6d:0e:97:a5:40:34:6b:2b:
                    d3:bc:66:eb:66:34:7c:fa:6b:8b:8f:57:29:99:f8:
                    30:17:5d:ba:72:6f:fb:81:c5:ad:d2:86:58:3d:17:
                    c7:e7:09:bb:f1:2b:f7:86:dc:c1:da:71:5d:d4:46:
                    e3:cc:ad:25:c1:88:bc:60:67:75:66:b3:f1:18:f7:
                    a2:5c:e6:53:ff:3a:88:b6:47:a5:ff:13:18:ea:98:
                    09:77:3f:9d:53:f9:cf:01:e5:f5:a6:70:17:14:af:
                    63:a4:ff:99:b3:93:9d:dc:53:a7:06:fe:48:85:1d:
                    a1:69:ae:25:75:bb:13:cc:52:03:f5:ed:51:a1:8b:
                    db:15
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage: 
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier: 
                14:2E:B3:17:B7:58:56:CB:AE:50:09:40:E6:1F:AF:9D:8B:14:C2:C6
            X509v3 Authority Key Identifier: 
                keyid:79:B4:59:E6:7B:B6:E5:E4:01:73:80:08:88:C8:1A:58:F6:E9:9B:6E

            Authority Information Access: 
                CA Issuers - URI:http://x1.i.lencr.org/

            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://x1.c.lencr.org/

            X509v3 Certificate Policies: 
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.44947.1.1.1

    Signature Algorithm: sha256WithRSAEncryption
         85:ca:4e:47:3e:a3:f7:85:44:85:bc:d5:67:78:b2:98:63:ad:
         75:4d:1e:96:3d:33:65:72:54:2d:81:a0:ea:c3:ed:f8:20:bf:
         5f:cc:b7:70:00:b7:6e:3b:f6:5e:94:de:e4:20:9f:a6:ef:8b:
         b2:03:e7:a2:b5:16:3c:91:ce:b4:ed:39:02:e7:7c:25:8a:47:
         e6:65:6e:3f:46:f4:d9:f0:ce:94:2b:ee:54:ce:12:bc:8c:27:
         4b:b8:c1:98:2f:a2:af:cd:71:91:4a:08:b7:c8:b8:23:7b:04:
         2d:08:f9:08:57:3e:83:d9:04:33:0a:47:21:78:09:82:27:c3:
         2a:c8:9b:b9:ce:5c:f2:64:c8:c0:be:79:c0:4f:8e:6d:44:0c:
         5e:92:bb:2e:f7:8b:10:e1:e8:1d:44:29:db:59:20:ed:63:b9:
         21:f8:12:26:94:93:57:a0:1d:65:04:c1:0a:22:ae:10:0d:43:
         97:a1:18:1f:7e:e0:e0:86:37:b5:5a:b1:bd:30:bf:87:6e:2b:
         2a:ff:21:4e:1b:05:c3:f5:18:97:f0:5e:ac:c3:a5:b8:6a:f0:
         2e:bc:3b:33:b9:ee:4b:de:cc:fc:e4:af:84:0b:86:3f:c0:55:
         43:36:f6:68:e1:36:17:6a:8e:99:d1:ff:a5:40:a7:34:b7:c0:
         d0:63:39:35:39:75:6e:f2:ba:76:c8:93:02:e9:a9:4b:6c:17:
         ce:0c:02:d9:bd:81:fb:9f:b7:68:d4:06:65:b3:82:3d:77:53:
         f8:8e:79:03:ad:0a:31:07:75:2a:43:d8:55:97:72:c4:29:0e:
         f7:c4:5d:4e:c8:ae:46:84:30:d7:f2:85:5f:18:a1:79:bb:e7:
         5e:70:8b:07:e1:86:93:c3:b9:8f:dc:61:71:25:2a:af:df:ed:
         25:50:52:68:8b:92:dc:e5:d6:b5:e3:da:7d:d0:87:6c:84:21:
         31:ae:82:f5:fb:b9:ab:c8:89:17:3d:e1:4c:e5:38:0e:f6:bd:
         2b:bd:96:81:14:eb:d5:db:3d:20:a7:7e:59:d3:e2:f8:58:f9:
         5b:b8:48:cd:fe:5c:4f:16:29:fe:1e:55:23:af:c8:11:b0:8d:
         ea:7c:93:90:17:2f:fd:ac:a2:09:47:46:3f:f0:e9:b0:b7:ff:
         28:4d:68:32:d6:67:5e:1e:69:a3:93:b8:f5:9d:8b:2f:0b:d2:
         52:43:a6:6f:32:57:65:4d:32:81:df:38:53:85:5d:7e:5d:66:
         29:ea:b8:dd:e4:95:b5:cd:b5:56:12:42:cd:c4:4e:c6:25:38:
         44:50:6d:ec:ce:00:55:18:fe:e9:49:64:d4:4e:ca:97:9c:b4:
         5b:c0:73:a8:ab:b8:47:c2
osiris@erazer ~ $

Looks kinda the same, but isn't.

6 Likes
4

But that's the cert I got from LE? Don't know what happened.

But you're right: I looked closer and there are some weird things. For example, this serial number:

Serial Number:
            3d:20:61:70:72:69:6c:20:66:6f:6f:6c:73:20:3d

doesn't really look that random to me. Anyone know what's up?

5 Likes
5

I just got a brand new cert with the --preferred-chain "ISRG Root X1" option and I received the chain with the "proper" intermediate R3 certificate.

So no idea where your cert came from. Do you have some "manual" chain magic perhaps?

Also interestingly your certificate doesn't have any SCTs, so it doesn't seem to be a valid, publicly trusted certificate to begin with. Looks like you didn't get the certificate from Let's Encrypt at all. Which ACME server was configured in your ACME client? Looks like an ACME server which wants to imitate Let's Encrypt, but actually isn't.

6 Likes
6

btw debian lenny is like 2012ish
and crt.sh record shows you have a cert in March 15th, and using an account that opt-in for E1 key using ecdsa pubkey

don't think acme client use is normal one you used at all.

6 Likes
7

Yeah I haven't upgraded in a while. It works how I want it to, so never touch a running system.

I don't use ACME. I use curl.

5 Likes
8

but all the other cert on crt.sh is ecdsa key but the one you given is RSA one.
and i don't think human can sign jwt by hand

5 Likes
9

You've used an ACME client to get the certificates for your website.

I managed to get a perfectly fine certificate/chain from the Let's Encrypt production server and I'm not seeing this Community flooding with threads with problems similar to yours, so I'm enclined to conclude it must have something to do with your website specifically.

5 Likes
10

I don't think an ACME client was involved here...

Ah, perhaps this was just a bad batch. Still wonder what went wrong though.

5 Likes
11

Your websites server is sending an untrusted certificate and chain from an unknown root certificate. Unless your webserver has been hacked or there's a Man-in-the-Middle attack going on, there is probably something wrong with your servers ACME client.

A "bad batch" of what? Let's Encrypt sending out a completely untrusted chain of certificate(s)? That would be a major incident.

6 Likes
12

@Nummer378 April 1. Nice Try! :slight_smile:

9 Likes
13

Oh for fucks sake. If that's really the case, I reaaaaally fell for it :rofl:

8 Likes
14

This is the very first webserver to have ever existed. Development ceased in 1996.

Is indeed from 2012.

Because who cares about incident response?

Who needs an ACME client anyway?

I suggest a hex-to-ASCII decoder :grinning:

I had so much fun, thanks for playing!

8 Likes
15

I must say, I did think "Why is the level of competence of @Nummer378 suddenly significantly lower than usual? Did he have a stroke?" but didn't link it to the current day :scream: :joy:

8 Likes
16 
tumbleweed:~ # echo 3d:20:61:70:72:69:6c:20:66:6f:6f:6c:73:20:3d | xxd -r -p ; echo
= april fools =
tumbleweed:~ #
7 Likes
17

I thought the same thing. Good to laugh once and a while!

8 Likes
18

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.