# Gmail app cert not trusted **URL:** \ **Category:** Help\ **Created:** [April 28, 2023, 2:45pm UTC](https://community.letsencrypt.org/t/gmail-app-cert-not-trusted/197309 "2023-04-28T14:45:31Z")\ **Posts on this page:** 16\ **Page:** 3
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [May 1, 2023, 10:24pm UTC](https://community.letsencrypt.org/t/gmail-app-cert-not-trusted/197309/41 "2023-05-01T22:24:51Z")
> [@tendouserr](#): > > should i switch to certbot? Why? I have described a supported way to fix the default acme.sh uses and possibly another way. Your problem now is you are now rate limited from doing the wrong thing too many times. Certbot won't fix that. You have to wait ---
**Author:** ![tendouserr](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/tendouserr/32/64101_2.png) [@tendouserr](https://community.letsencrypt.org/u/tendouserr)\ **Post date:** [May 2, 2023, 12:39pm UTC](https://community.letsencrypt.org/t/gmail-app-cert-not-trusted/197309/42 "2023-05-02T12:39:35Z")
> [@MikeMcQ](#): > > On my system I believe I could remove the appropriate line from the `ca.conf` file because that's where this setting went. But, I am not an acme.sh expert so not sure if that is safe to do. > > ```nohighlight > ~/.acme.sh/ca/acme-v02.api.letsencrypt.org/directory]> ls -l > total 12 > -rw-rw-r-- 1 ubuntu ubuntu 544 Oct 25 2022 account.json > -rw------- 1 ubuntu ubuntu 1679 Oct 25 2022 account.key > -rw-rw-r-- 1 ubuntu ubuntu 196 May 1 20:32 ca.conf > > cat ca.conf > > CA_EMAIL='example@example.com' > ACCOUNT_URL='https://acme-v02.api.letsencrypt.org/acme/acct/[redacted]' > CA_KEY_HASH='[redacted]' > DEFAULT_PREFERRED_CHAIN='ISRG' > > ``` > > You could ask this about this on the acme.sh github for some reason, is not detecting DST ```nohighlight cat .acme.sh/ca/acme-v02.api.letsencrypt.org/directory/ca.conf CA_EMAIL='webmaster@inverlandpanama.com' ACCOUNT_URL='https://acme-v02.api.letsencrypt.org/acme/acct/ *******' CA_KEY_HASH='[******]' DEFAULT_PREFERRED_CHAIN='DST' ``` I will ask namecheap but probably they do this on purpose since they claim no support to letsencrypt ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [May 2, 2023, 1:16pm UTC](https://community.letsencrypt.org/t/gmail-app-cert-not-trusted/197309/43 "2023-05-02T13:16:35Z")
> [@tendouserr](#): > > for some reason, is not detecting DST It might detect that but you cannot get a fresh certificate because you are Rate Limited. You will need to wait a few more days to try again. > [@tendouserr](#): > > ```nohighlight > [Mon May 1 16:58:28 EDT 2023] Create new order error. Le_OrderFinalize not found. { > "type": "urn:ietf:params:acme:error:rateLimited", > "detail": "Error creating new order :: too many certificates (5) already issued for this exact set of domains in the last 168 hours: inverlandpanama.com,www.inverlandpanama.com, retry after 2023-05-03T04:09:50Z: see https://letsencrypt.org/docs/duplicate-certificate-limit/", > "status": 429 > } > > ``` ---
**Author:** ![tendouserr](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/tendouserr/32/64101_2.png) [@tendouserr](https://community.letsencrypt.org/u/tendouserr)\ **Post date:** [May 2, 2023, 1:20pm UTC](https://community.letsencrypt.org/t/gmail-app-cert-not-trusted/197309/44 "2023-05-02T13:20:54Z")
> [@MikeMcQ](#): > > It might detect that but you cannot get a fresh certificate because you are Rate Limited. You will need to wait a few more days to try again. remember I ran the proper command before restriction.... here the prove `DEFAULT_PREFERRED_CHAIN='DST'` I didn't edit that file manually ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [May 2, 2023, 1:35pm UTC](https://community.letsencrypt.org/t/gmail-app-cert-not-trusted/197309/45 "2023-05-02T13:35:52Z")
That conf file can be changed at any time. It is not certain to me whether that was done before or after your most recent cert. What do you do with the cert files once you get them? And, which cert files do you use? ---
**Author:** ![tendouserr](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/tendouserr/32/64101_2.png) [@tendouserr](https://community.letsencrypt.org/u/tendouserr)\ **Post date:** [May 2, 2023, 10:34pm UTC](https://community.letsencrypt.org/t/gmail-app-cert-not-trusted/197309/46 "2023-05-02T22:34:18Z")
> [@MikeMcQ](#): > > What do you do with the cert files once you get them? > > And, which cert files do you use? I did everything through acme.sh script so I didn't edit any other file manually BTW, I contacted namecheap and as I informed previously they don't support third party certificates cheers! ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [May 2, 2023, 11:12pm UTC](https://community.letsencrypt.org/t/gmail-app-cert-not-trusted/197309/47 "2023-05-02T23:12:07Z")
> [@tendouserr](#): > > I did everything through acme.sh script After a successful run of acme.sh it creates several files for the certs. We can see you getting these certs in the public cert logs ([link here](https://tools.letsdebug.net/cert-search?m=domain&q=inverlandpanama.com&d=168)) You have a LiteSpeed server that uses those cert files for HTTPS. And, we can see that LiteSpeed is using the most recent cert you got. You also have Dovecot handling mail on port 993. It is also using the latest cert you got. So, how did LiteSpeed and Dovecot know to use that latest cert? Do you copy the cert files somehow? Or, have you configured them to use the file(s) in the acme.sh folder? If so, which files have you configured them to use? ---
**Author:** ![tendouserr](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/tendouserr/32/64101_2.png) [@tendouserr](https://community.letsencrypt.org/u/tendouserr)\ **Post date:** [May 3, 2023, 1:05am UTC](https://community.letsencrypt.org/t/gmail-app-cert-not-trusted/197309/48 "2023-05-03T01:05:56Z")
> [@MikeMcQ](#): > > So, how did LiteSpeed and Dovecot know to use that latest cert? Do you copy the cert files somehow? Or, have you configured them to use the file(s) in the acme.sh folder? If so, which files have you configured them to use? I haven't done any of these as I stated before.... I'm noob to letsencrypt and even any other SSL provider what do you suggest I do? just wait for acme.sh rate limit to go away? ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [May 3, 2023, 2:27am UTC](https://community.letsencrypt.org/t/gmail-app-cert-not-trusted/197309/49 "2023-05-03T02:27:33Z")
Sorry but I do not know how to help you. There are many ways to manage servers. If you don't know even these basics I can't do it for you. My advice to you is to buy and use a service that you can manage. I think you have purchased a system that you are not yet able to understand. ---
**Author:** ![orangepizza](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/orangepizza/32/19597_2.png) [@orangepizza](https://community.letsencrypt.org/u/orangepizza)\ **Post date:** [May 3, 2023, 2:40am UTC](https://community.letsencrypt.org/t/gmail-app-cert-not-trusted/197309/50 "2023-05-03T02:40:36Z")
sorry I read it wrong ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [May 3, 2023, 2:55am UTC](https://community.letsencrypt.org/t/gmail-app-cert-not-trusted/197309/51 "2023-05-03T02:55:19Z")
> [@orangepizza](#): > > probed OP's imap server with s\_client ... didn't sent any ICA cert at all, just leaf Hmm. I see: ```nohighlight openssl s_client -connect inverlandpanama.com:993 --- Certificate chain 0 s:CN = inverlandpanama.com i:C = US, O = Let's Encrypt, CN = R3 a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256 v:NotBefore: May 1 18:33:50 2023 GMT; NotAfter: Jul 30 18:33:49 2023 GMT 1 s:C = US, O = Let's Encrypt, CN = R3 i:C = US, O = Internet Security Research Group, CN = ISRG Root X1 a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256 v:NotBefore: Sep 4 00:00:00 2020 GMT; NotAfter: Sep 15 16:00:00 2025 GMT --- ``` ---
**Author:** ![tendouserr](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/tendouserr/32/64101_2.png) [@tendouserr](https://community.letsencrypt.org/u/tendouserr)\ **Post date:** [May 11, 2023, 12:58am UTC](https://community.letsencrypt.org/t/gmail-app-cert-not-trusted/197309/52 "2023-05-11T00:58:14Z")
> [@rg305](#): > > OR > Switch free CAs what other completely free CA certificates are there? ---
**Author:** ![Bruce5051](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/bruce5051/32/76576_2.png) [@Bruce5051](https://community.letsencrypt.org/u/Bruce5051)\ **Post date:** [May 11, 2023, 1:36am UTC](https://community.letsencrypt.org/t/gmail-app-cert-not-trusted/197309/53 "2023-05-11T01:36:03Z")
> **[ACME CA Comparison - Posh-ACME](https://poshac.me/docs/v4/Guides/ACME-CA-Comparison/)** > > Documentation for the Posh-ACME PowerShell module ---
**Author:** ![Bruce5051](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/bruce5051/32/76576_2.png) [@Bruce5051](https://community.letsencrypt.org/u/Bruce5051)\ **Post date:** [May 11, 2023, 2:48am UTC](https://community.letsencrypt.org/t/gmail-app-cert-not-trusted/197309/54 "2023-05-11T02:48:38Z")
And of course there is the Free (non ACME) CA that nobody likes [https://www.cacert.org](https://www.cacert.org) ---
**Author:** ![tendouserr](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/tendouserr/32/64101_2.png) [@tendouserr](https://community.letsencrypt.org/u/tendouserr)\ **Post date:** [May 15, 2023, 5:00am UTC](https://community.letsencrypt.org/t/gmail-app-cert-not-trusted/197309/55 "2023-05-15T05:00:07Z")
done via cpanel! > **[SSL Checker](https://decoder.link/sslchecker/inverlandpanama.com/443)** > > Verify that your SSL certificate is installed correctly, identify installation issues if any. cheers! ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [June 14, 2023, 5:00am UTC](https://community.letsencrypt.org/t/gmail-app-cert-not-trusted/197309/56 "2023-06-14T05:00:44Z")
Closed on June 14, 2023, 5:00am UTC This topic was automatically closed 30 days after the last reply. New replies are no longer allowed. [Previous page](https://community.letsencrypt.org/t/gmail-app-cert-not-trusted/197309.md?page=2)