# Err\_cert\_authority\_invalid **URL:** \ **Category:** Help\ **Created:** [September 8, 2021, 12:02pm UTC](https://community.letsencrypt.org/t/err-cert-authority-invalid/159422 "2021-09-08T12:02:01Z")\ **Posts on this page:** 16\ **Page:** 1
**Author:** ![pipa\_85](https://avatars.discourse-cdn.com/v4/letter/p/90db22/32.png) [@pipa\_85](https://community.letsencrypt.org/u/pipa_85)\ **Post date:** [September 8, 2021, 12:02pm UTC](https://community.letsencrypt.org/t/err-cert-authority-invalid/159422/1 "2021-09-08T12:02:01Z")
Hello, As I mentioned in this [post](https://community.letsencrypt.org/t/invalid-intermediate-certificate/142712) we import our certificates and intermediate certificates into fortiweb. Since the intermediate certificate we are currently using will expire on September 29, 2021, I uploaded another one ([this one](https://letsencrypt.org/certs/lets-encrypt-r3.pem)) but when I use it, the message bellow is shown for some users : **Your connection is not private** **Attackers might be trying to steal your information from..... etc** **ERR\_CERT\_AUTHORITY\_INVALID** knowing that the CA certificate that we are currently using in Fortiweb is: ![CA_cert](https://global.discourse-cdn.com/letsencrypt/original/3X/5/1/51ae9421e5432c499cea330110350333eef29fbb.png) I guess I need to upload the new CA certificate as well, right? Can you please give me the right URL to download the new CA cert **NB: Whynopadlock doesn't show any error** Because of this problem, I am obliged to use the old intermediate certificate but it will expire on September 29 below, the intermediate certificates that are in fortiweb, the one selected is the one we are currently using: ![Intermediate_certs](https://global.discourse-cdn.com/letsencrypt/original/3X/2/d/2d8ce92e59fc53c3824a9af36b7b1dd103676917.png) Can you please help me. I thank you in advance ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [September 8, 2021, 12:52pm UTC](https://community.letsencrypt.org/t/err-cert-authority-invalid/159422/2 "2021-09-08T12:52:05Z")
> [@pipa\_85](#): > > when I use it, the message bellow is shown for some users : > > **Your connection is not private** How are they _using_ it? (which browser, etc.) Can you show a URL that trips this message? ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [September 8, 2021, 12:52pm UTC](https://community.letsencrypt.org/t/err-cert-authority-invalid/159422/3 "2021-09-08T12:52:54Z")
> [@pipa\_85](#): > > I uploaded another one ([this one](https://letsencrypt.org/certs/lets-encrypt-r3.pem)) and: > [@pipa\_85](#): > > the CA certificate that we are currently using in Fortiweb What's the difference between those two? I.e., _where_ are you using the R3 intermediate and _what_ is the function of the "CA certificate" in Fortiweb? Also, please share the hostname of the site you're having trouble with. And as also mentioned in your previous thread: you should NOT hard-code any intermediate **EVER** but let the ACME client handle the intermediate certificates gracefully without any manual tampering. ---
**Author:** ![Nummer378](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/nummer378/32/49862_2.png) [@Nummer378](https://community.letsencrypt.org/u/Nummer378)\ **Post date:** [September 8, 2021, 3:00pm UTC](https://community.letsencrypt.org/t/err-cert-authority-invalid/159422/4 "2021-09-08T15:00:29Z")
> [@pipa\_85](#): > > knowing that the CA certificate that we are currently using in Fortiweb is: > > ![CA_cert](https://global.discourse-cdn.com/letsencrypt/original/3X/5/1/51ae9421e5432c499cea330110350333eef29fbb.png) This is Let's Encrypt Authority **X3** , which has been retired in December 2020. Even if there's a version of X3 that is not yet expired\*, **all** certificates are currently signed with a different keypair - making this intermediate certificate completly invalid. As already stated by Osiris, you should **not** manage intermediate certificates manually. \*X3 signed by DST Root CA X3 has already expired in March this year, but X3 signed by ISRG Root X1 will expire on 2021-10-06 - however this deadline is not important, given that the intermediate has already become obsolete. Also, in your first screenshot it reads CA\_Cert\_1, but later all entries show Inter\_Cert\_\*. In the latter screenshot, no X3 is present - only R3 (which is correct). I don't see how they correlate. ---
**Author:** ![pipa\_85](https://avatars.discourse-cdn.com/v4/letter/p/90db22/32.png) [@pipa\_85](https://community.letsencrypt.org/u/pipa_85)\ **Post date:** [September 8, 2021, 9:15pm UTC](https://community.letsencrypt.org/t/err-cert-authority-invalid/159422/5 "2021-09-08T21:15:40Z")
below, a screenshot of what is displayed for me in chrome, sorry it's in french but the error is in english. other users log in with their phones, i don't know exactly which browser they are using. Our domain is: elearning.univ-bejaia.dz ![ERR_Cert_Authority_Invalid](https://global.discourse-cdn.com/letsencrypt/original/3X/5/9/59dc504562da0a4532669450837042254d4b97be.jpeg) ---
**Author:** ![pipa\_85](https://avatars.discourse-cdn.com/v4/letter/p/90db22/32.png) [@pipa\_85](https://community.letsencrypt.org/u/pipa_85)\ **Post date:** [September 8, 2021, 9:18pm UTC](https://community.letsencrypt.org/t/err-cert-authority-invalid/159422/6 "2021-09-08T21:18:37Z")
I never hard-code any intermediate, I neither have the need nor the skills to do this As I mentioned in my [old post](https://community.letsencrypt.org/t/error-failed-to-connect-to-x-x-x-x-443-for-tls-sni-01-challenge/30408/41), to set up the https for our site, we had to import into fortiweb the certificate of the certification authority, the intermediate certificate, the server certificate and the private key. So I just followed the instructions I found in the Fortiweb documentation ---
**Author:** ![pipa\_85](https://avatars.discourse-cdn.com/v4/letter/p/90db22/32.png) [@pipa\_85](https://community.letsencrypt.org/u/pipa_85)\ **Post date:** [September 8, 2021, 9:30pm UTC](https://community.letsencrypt.org/t/err-cert-authority-invalid/159422/7 "2021-09-08T21:30:24Z")
When we use the **Inter\_cert2** , le site works fine but when we use the **Inter\_cert3** the error is shown for some users. Currently we use the **Inter\_cert2** but It will expire on septembre, 29 What does the error below means exactly ? **ERR\_CERT\_AUTHORITY\_INVALID** ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [September 8, 2021, 11:16pm UTC](https://community.letsencrypt.org/t/err-cert-authority-invalid/159422/9 "2021-09-08T23:16:01Z")
It seems that **Inter\_cert3** is the one to use. If there are some users that are having trouble with it, it is likely a problem with that users' trust store. [likely missing the **ISRG Root X1** cert] Maybe you can switch to it and let us test it out from here (then switch back). ---
**Author:** ![pipa\_85](https://avatars.discourse-cdn.com/v4/letter/p/90db22/32.png) [@pipa\_85](https://community.letsencrypt.org/u/pipa_85)\ **Post date:** [September 9, 2021, 10:03am UTC](https://community.letsencrypt.org/t/err-cert-authority-invalid/159422/10 "2021-09-09T10:03:06Z")
I am using the **Inter\_cert3** now can you please test it Thank you ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [September 9, 2021, 10:12am UTC](https://community.letsencrypt.org/t/err-cert-authority-invalid/159422/11 "2021-09-09T10:12:41Z")
Done. Everything is right with **Inter\_cert3**. The problems experienced with the clients must be within the client systems. ---
**Author:** ![pipa\_85](https://avatars.discourse-cdn.com/v4/letter/p/90db22/32.png) [@pipa\_85](https://community.letsencrypt.org/u/pipa_85)\ **Post date:** [September 9, 2021, 10:47am UTC](https://community.letsencrypt.org/t/err-cert-authority-invalid/159422/12 "2021-09-09T10:47:23Z")
I still have the same problem with chrome but not with firefox ![Chrome](https://global.discourse-cdn.com/letsencrypt/original/3X/9/1/91ac2f62c3efdcdaec27df6940a0e7ae3ceb2843.jpeg) ![Firefox](https://global.discourse-cdn.com/letsencrypt/original/3X/9/d/9dd4e5a18ee6808bbdce61077d6029e94f0d8b11.jpeg) ---
**Author:** ![pipa\_85](https://avatars.discourse-cdn.com/v4/letter/p/90db22/32.png) [@pipa\_85](https://community.letsencrypt.org/u/pipa_85)\ **Post date:** [September 9, 2021, 10:59am UTC](https://community.letsencrypt.org/t/err-cert-authority-invalid/159422/13 "2021-09-09T10:59:14Z")
Can you please access to our site with google chrome and tell me if it's ok [https://elearning.univ-bejaia.dz/](https://elearning.univ-bejaia.dz/) ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [September 9, 2021, 11:57am UTC](https://community.letsencrypt.org/t/err-cert-authority-invalid/159422/14 "2021-09-09T11:57:42Z")
I just tried it with Opera and Edge on my PC and Chrome on my Samsung mobile (sorry, no Chrome on my PC). All saw your site fine. It is now 11:56 UTC ---
**Author:** ![Nummer378](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/nummer378/32/49862_2.png) [@Nummer378](https://community.letsencrypt.org/u/Nummer378)\ **Post date:** [September 9, 2021, 2:21pm UTC](https://community.letsencrypt.org/t/err-cert-authority-invalid/159422/15 "2021-09-09T14:21:45Z")
Your site is not sending **any** intermediate certificate. It is just sending the leaf certificate: ```nohighlight # openssl s_client -connect elearning.univ-bejaia.dz:443 CONNECTED(00000184) depth=0 CN = elearning.univ-bejaia.dz verify error:num=20:unable to get local issuer certificate verify return:1 depth=0 CN = elearning.univ-bejaia.dz verify error:num=21:unable to verify the first certificate verify return:1 depth=0 CN = elearning.univ-bejaia.dz verify return:1 --- Certificate chain 0 s:CN = elearning.univ-bejaia.dz i:C = US, O = Let's Encrypt, CN = R3 --- ``` This also explains while it works on some systems while it doesn't work with others. Clients that have R3 cached (or can load it externally) will have no problems connecting to your site, other clients will show validation errors. Your site should actually be serving two intermediates (R3 signed by ISRG Root X1 and ISRG Root X1 signed by DST Root CA X3), but I'm still not understanding why you're trying to configure intermediate certificates manually. Nothing in the guides I've found about FortiWeb ([1](https://blog.boll.ch/fortiweb-v6-4-0-and-lets-encrypt/), [2](https://docs.fortinet.com/document/fortiweb/6.4.0/administration-guide/968374/lets-encrypt-certificates)) implies that this is necessary. ---
**Author:** ![pipa\_85](https://avatars.discourse-cdn.com/v4/letter/p/90db22/32.png) [@pipa\_85](https://community.letsencrypt.org/u/pipa_85)\ **Post date:** [September 11, 2021, 11:19am UTC](https://community.letsencrypt.org/t/err-cert-authority-invalid/159422/16 "2021-09-11T11:19:14Z")
Hello, Thank you very much for your help, indeed, I only imported the R3 signed by ISRG Root X1. Now, I imported also the ISRG Root X1 signed by DST Root CA X3 so, the problem is solved, I mean it works with google chrome and the whynopadlock and ssl Labs sites dont show any errors. But I will see if the users don't complain. **The links you provided me are very interesting but they concern the version 6.4 of fortiweb and above, unfortunately, the version that we have is much lower, it doesn't support the integration with Let’s Encrypt yet to automatiquely generate server's certificate. So, I am obliged to do it manualy.** Now I will answer your question, why do I have to manually manipulate intermediate certificates. In 2017, I wanted to set up https for our site, so, I generated the certificate and I configured the apache virtual host to serve it but It deosn't work, when I test my site with whynopadlock site, it always detects the Fortiweb certificate rather than the let's encryp certificate ([as you can see it here](https://community.letsencrypt.org/t/error-failed-to-connect-to-x-x-x-x-443-for-tls-sni-01-challenge/30408/35)). By doing some research, I found in the Fortiweb documentation that it is necessary to import the CA's certificate and the server's certificate into fortiweb (you can doawload the fortiweb's administration guide [here](https://s3.amazonaws.com/fortinetweb/docs.fortinet.com/v2/attachments/eb907304-202d-11e9-b6f6-f8bc1258b856/FortiWeb_5_3_Administration_Guide_Revision1.pdf) on page 295, 298 and 308), At that time, we had the version 5.3 of fortiweb, so, I imported into fortiweb cert.pem as well as privkey.pem. It is also written in the documentation that if the certificate is not signed by a root CA then, I must also import the intermediate certificate (ie: the certificate of let's encryp which is an intermediate certificate, page 310) finally. in the server policy I had to select the certificate of my server (cert.pem) and the intermediaries. Doing that, the https worked very wel. Below, the configuration of the server policy: ![Server policy](https://global.discourse-cdn.com/letsencrypt/original/3X/e/b/eb1497b195acda61cf6dfbeafbbcd38c1bc6c230.png) Currently, I import fullchain.pem and privkey.pem (I no longer use cert.pem). I said to myself the last thirsdays I should not import the intermediate certificates manualy since the fullchain.pem contains the server's certificate as wel as the intermediate certificates, so, I tryed to not use (not select) the **Inter\_group1** (wich contains the intermediaries) in the server policy but when I did that, the whynopadlock indicates that I have an invalid or missing intermediate certificate. So,I had to select that group again in the server policy, knowing that the **Inter\_group1** group contains the R3 signed by ISRG Root X1 and the ISRG Root X1 signed by DST Root CA X3 ![Inter_cert](https://global.discourse-cdn.com/letsencrypt/original/3X/6/0/603ea0571701f6147df0c7d4696f1b0e29bfcb78.png) ![Intermediate CA Group](https://global.discourse-cdn.com/letsencrypt/original/3X/8/3/83f4af204ecc508309ff9e34cc35e2bb8db8e641.png) I will continue my research to find a solution not to manually import intermediate certificates with our current version of forti web, while waiting to update fortiweb to the version 6.4.0 that supports the integration with let's encrypt to automatiquely generate server's certificate. ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [October 11, 2021, 11:19am UTC](https://community.letsencrypt.org/t/err-cert-authority-invalid/159422/17 "2021-10-11T11:19:31Z")
Closed on October 11, 2021, 11:19am UTC This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.