A post was merged into an existing topic: Fixing validation from CentOS instances
10 posts were split to a new topic: Problem getting certificate re-issued; cPanel AutoSSL and rate limit
A post was split to a new topic: OS X 10.11 clients not connecting to site with Let's Encrypt certificates
2 posts were merged into an existing topic: Amazon AMIs failing to connect to backends; modifying ca-bundle
2 posts were merged into an existing topic: Certificates are not trusted on Chrome and Safari on old iMac with El Capitan
If you have any questions about whether you need to do anything special for the upcoming DST Root CA X3 expiration in September 2021, please post them here. A staff member may split out some conversations into their own threads.
Note: Your first step in debugging should be to update your operating system. Most problems are solved by running the latest operating system available for your machine, and staying up to date will also make you more secure.
Update 30 September 2021
Yesterday, the R3 signed by DST Root CA X3 intermediate expired as planned. If you experience problems related to certificate chaining you should first review your configuration and make sure your server/website/device is sending the correct chain with the updated R3 intermediate signed by ISRG Root X1. It is unlikely that you need to force renewal to resolve issues related to R3 signed by DST Root CA X3 expiring. This thread and many more on the community offer advice to review and resolve this problem.
Earlier today, the DST Root CA X3 expired as planned. Most problems related to DST Root CA X3 expiring will not be solved by force renewal. Please search the forum and this this thread for help to resolve the problems you are experiencing before opening a new thread.
12 Likes
Hello Lets Encrypt.
My question is about Zimbra. After install or renew a cert, Zimbra asks to insert to chain.pem the IdenTrust root Certificate also. Otherwise will not deploy it.
The instructions are here: Installing a LetsEncrypt SSL Certificate - Zimbra :: Tech Center
What will happen after 11/21? Will Zimbra recognize Letsencrypt CA?
Thank you in advance.
2 Likes
If you have a test environment, or you can afford the Zimbra environment you do have to potentially be unavailable for a period (e.g. planned engineering) you should test what happens if you omit this step in their instructions.
This additional item in the chain will not be necessary for the web browser to trust your certificate, so the question is only whether for some reason the Zimbra software itself requires this certificate, which it should not do. If everything works perfectly without, you should advise the maintainers to update the instructions you linked, they seem quite old so it's possible they already knew they're wrong and should be updated. If things break, you could report that here, but most importantly alert the Zimbra maintainers that they've got a problem looming.
4 Likes
Thank you for your answer.
Our Zimbra server is very productive and actually the mail server one of our client.
Unfortunately we have to wait until next cert renew and see what will happened.
Zimbra forum don't have yet something similar. I'll try there and came back for new information.
Thank you.
4 Likes