Help thread for DST Root CA X3 expiration (September 2021)

Help
1155

Yes, some Firewalls are taking issue with the Multiple Certificate Chain/Paths.

For example Qualys SSL Server Test even shows Certification Path #2 for community.letsencrypt.org with the Expired Certificate. For this reason some Firewalls that perform SSL Scanning (Proxying) take issue.

https://www.ssllabs.com/ssltest/analyze.html?d=community.letsencrypt.org&s=2602%3Afd3f%3A3%3Aff01%3A0%3A0%3A0%3Aca&hideResults=on

See "Certification Paths" -> "Path #2: Not trusted (invalid certificate [Fingerprint SHA256: 0687260331a72403d909f105e69bcf0d32e1bd2493ffc6d9206d11bcd6770739])"

For Sophos UTM/SG Firewalls see: Service and Support

3 Likes