If you have any questions about whether you need to do anything special for the upcoming DST Root CA X3 expiration in September 2021, please post them here. A staff member may split out some conversations into their own threads. Note: Your first step in debugging should be to update your operating …

Hi @nertzy , welcome to the LE community forum :slight_smile: Thank you for the input; But without detail, it really doesn't say much more than a news story headline.

We are facing the same issues as @nertzy and have also opened issues with Heroku. Using the Heroku Ruby build pack when I check /etc/ssl/certs/ca-certificates.crt I am seeing ISRG Root X1 but not DST Root CA X3. The domain we are connecting to show the following when I check is with openssl s_clie…

Hi @howeszy , welcome to the LE community forum :slight_smile: It seems that site is using the old default chain. see post 146: Help thread for DST Root CA X3 expiration (September 2021) - #146 by griffin If you can communicate with the site operator, they might be able to change the chain being s…

@rg305 thank you for the quick response. I will reach out to them immediately. Also for anyone interested I found a response on Twitter from a Heroku Dev about this issue: Ubuntu removed the cert from ca-certificates slightly prior, so anyone using an official Ubuntu image would have this change.…

[image] howeszy: I will reach out to them immediately. Notice that the chain currently used shouldn't be in use after the certificate would have renewed after May this year. So the system administrator of the site isn't using the ACME protocol properly..

Hello. Will this occur worldwide? Also, will this affect sites that do not use LetsEncrypt?

Expiry happens at a particular moment in Universal Co-ordinated Time, so, yes, worldwide, and at essentially the same moment but for some people that will be in their afternoon or evening and others lunch time. Let's Encrypt is the only large issuer whose certificates might be trusted via DST Root …

Also, how long will this event last?

[image] FunXTime: how long will this event last? Don't blink or you will miss it! It just expires. No fireworks. No parade. No funeral procession. Just the clock ticking past its' lifespan. One second it is valid... And the next second it is not.

Help thread for DST Root CA X3 expiration (September 2021)

Help

jple September 29, 2021, 2:38pm 889

We updated the thread in API announcements with some more information about this change and some good starting points, should it be helpful to you!

Topic		Replies	Views
DST Root CA X3 expiry countdown ISRG/Organizational	103	10253	May 23, 2022
Understanding DST Root expiry and the older default cert chain Help	36	3696	December 8, 2021
R3 Intermediate certificate has expired Help	133	36839	November 1, 2021
Feedback wanted: DST Root CA X3 expiration all-subscriber email Issuance Tech	14	3130	May 6, 2021
Questions re: OpenSSL Client Compatibility Changes for Let’s Encrypt Certificates Issuance Tech	55	10315	September 7, 2021

Help thread for DST Root CA X3 expiration (September 2021)

Related topics