If you have any questions about whether you need to do anything special for the upcoming DST Root CA X3 expiration in September 2021, please post them here. A staff member may split out some conversations into their own threads. Note: Your first step in debugging should be to update your operating …

Hello Lets Encrypt. My question is about Zimbra. After install or renew a cert, Zimbra asks to insert to chain.pem the IdenTrust root Certificate also. Otherwise will not deploy it. The instructions are here: Installing a LetsEncrypt SSL Certificate - Zimbra :: Tech Center What will happen after…

If you have a test environment, or you can afford the Zimbra environment you do have to potentially be unavailable for a period (e.g. planned engineering) you should test what happens if you omit this step in their instructions. This additional item in the chain will not be necessary for the web br…

Thank you for your answer. Our Zimbra server is very productive and actually the mail server one of our client. Unfortunately we have to wait until next cert renew and see what will happened. Zimbra forum don't have yet something similar. I'll try there and came back for new information. Thank y…

I have one question, which is not answered on the docs page: for now, it looks like my certificates are signed by R3 which indicates an issuer of DST Root CA X3; when will the new chain be used in renewals? Those details seem to be available in this other topic: https://community.letsencrypt.org/t/…

Welcome to the Let's Encrypt Community :slightly_smiling_face: Great suggestion! I've submitted changes to reflect this to DST Root CA X3 Expiration (September 2021) - Let's Encrypt that are awaiting review. Added link to production chain changes thread …

Does this issue affect all vendor-supplied versions of OpenSSL 1.0.x? Or have some vendors patched theirs? I'm curious in particular about Ubuntu's 1.0.2g-1ubuntu4.19 which comes with 16.04 We're a bit behind with upgrading our systems unfortunately (16.04 was supported till April this year).

There are some details on how OpenSSL will break when DST Root X3 expires if a server is sending the default chain in this thread: [image] OpenSSL Client Compatibility Changes for Let’s Encrypt Certificates API Announcements L… And a questions for it thread, though i…

I've heard that OpenSSL 1.0.2 can be manually fixed by setting the flag X509_V_FLAG_TRUSTED_FIRST. This flag is not set by default in 1.0.2, but you might be able to do this in your client applications (it can also potentially be done via config file nope, doesn't look like it). I haven't tested th…

Help thread for DST Root CA X3 expiration (September 2021)

Help

griffin May 7, 2021, 4:27pm 688

If you have received a notification email containing an unfamiliar domain name, please see the Let's Encrypt staff message here:

Topic		Replies	Views
DST Root CA X3 expiry countdown ISRG/Organizational	102	10417	October 1, 2021
Understanding DST Root expiry and the older default cert chain Help	35	3785	November 8, 2021
R3 Intermediate certificate has expired Help	130	38115	October 2, 2021
Feedback wanted: DST Root CA X3 expiration all-subscriber email Issuance Tech	13	3168	April 6, 2021
Questions re: OpenSSL Client Compatibility Changes for Let’s Encrypt Certificates Issuance Tech	52	10430	August 31, 2021

Help thread for DST Root CA X3 expiration (September 2021)

Related topics