Help thread for DST Root CA X3 expiration (September 2021)

rg305 · October 1, 2021, 1:51pm

Try:
openssl s_client -connect EXAMPLE.COM:443 -servername EXAMPLE.COM
[feel free to check all other ports too - not just 443]

Bruce5051 · October 1, 2021, 1:51pm

@rg305 I am Old ad use Androids.

rg305 · October 1, 2021, 1:54pm

criton2000:

---
Certificate chain
 0 s:CN = hub1.cet.cloud
   i:C = US, O = Let's Encrypt, CN = R3
 1 s:C = US, O = Let's Encrypt, CN = R3
   i:O = Digital Signature Trust Co., CN = DST Root CA X3
---

That is a very weird chain to be serving today.
Please show file:
/etc/letsencrypt/live/hub1.cet.cloud/fullchain.pem

negous7 · October 1, 2021, 1:54pm

This is causing some very serious damage since it surfaced.
I find it hard to believe that LE has not made any efforts to minimize the damage they have caused. The usual answer "They need to update their devices", although correct and true, has no application to digital agencies, or hosting companies that have clients (which in turn have clients also) and they have to explain to them was has happened.
Bottom line: is there any WORKING & SPECIFIC solution (server-side) that we can follow, even temporarily? Do we need to purchase SSLs and get it over with?
If there is something to be downloaded / replaced, please be thorough with your instructions (@rg305 we really appreciate your efforts). As you can imagine, servers with live websites are not so simple to be powered on or off numerous times a day just to "test if this works".

A responsible answer to the above, please.

matthkarl · October 1, 2021, 1:56pm

@rg305
It's the same result. Port 465 is where the mail client connects to.

rg305 · October 1, 2021, 1:57pm

@AndersonSilvestre , welcome to the LE community forum

Please speak with your Hosting Service Provider (HSP) about that problem.
It is surely affecting all users of that system.

rg305 · October 1, 2021, 1:59pm

That port looks good.
How about 25 (with STARTTLS)
OR 993
OR 587
...

criton2000 · October 1, 2021, 2:00pm

and it seems to correspond to what is extracted from freecert.pfx file

rg305 · October 1, 2021, 2:02pm

Hi @Picasso701, welcome to the LE community forum

This may not be directly relevant to your firewall brand (unknown).
But it may help explain what choices are out there that others are making in the situation:
https://kb.fortinet.com/kb/documentLink.do?externalID=FD49028

rg305 · October 1, 2021, 2:04pm

@abu1
The site is not serving any chain (at all).
If you are using certbot, then switch from using cert.pem to using fullchain.pem

RealTimeData · October 1, 2021, 2:06pm

Yes, some Firewalls are taking issue with the Multiple Certificate Chain/Paths.

For example Qualys SSL Server Test even shows Certification Path #2 for community.letsencrypt.org with the Expired Certificate. For this reason some Firewalls that perform SSL Scanning (Proxying) take issue.

https://www.ssllabs.com/ssltest/analyze.html?d=community.letsencrypt.org&s=2602%3Afd3f%3A3%3Aff01%3A0%3A0%3A0%3Aca&hideResults=on

See "Certification Paths" -> "Path #2: Not trusted (invalid certificate [Fingerprint SHA256: 0687260331a72403d909f105e69bcf0d32e1bd2493ffc6d9206d11bcd6770739])"

For Sophos UTM/SG Firewalls see: Service and Support

rg305 · October 1, 2021, 2:06pm

Hi @nerdaliciousCH welcome to the LE community forum

Because it is still the preferred chain.
You can chose to use the other valid trust path.

matthkarl · October 1, 2021, 2:08pm

@rg305

993 is again the same. 587 does not respond, neither 25. Port 25 is the unencrypted one. How would I test that STARTTLS?

abu1 · October 1, 2021, 2:09pm

We are using acme.sh. Is there a different solution for this? If not, how do I make this switch? Thanks again

rosshambleton · October 1, 2021, 2:11pm

Has anyone got this working on a Debian based web server? My Xamarin Android app can't connect to its API due to the certificate expiry.

rg305 · October 1, 2021, 2:16pm

@criton2000
hmm... pfx...
Then you are using Windows; And it probably doesn't have the "ISRG Root X1" in the trusted store.
[and possibly not even the "R3" intermediate (not actually required)]
And Windows is doing w/e it feels like with that included information (nothing).

Try adding the "ISRG Root X1" cert to the trust store.
[might need a reboot and/or rebinding of IIS to the cert]
You can find it here:
Self-signed: der, pem

rg305 · October 1, 2021, 2:20pm

openssl s_client -connect EXAMPLE.COM:25 -starttls smtp

rg305 · October 1, 2021, 2:23pm

For acme.sh change the EXAMPLE.COM.cer for fullchain.cer

matthkarl · October 1, 2021, 2:24pm

@reg305

Port 25 didn't give a reply. On Port 465 I got this:

CONNECTED(00000003)
Didn't find STARTTLS in server response, trying anyway...
write:errno=0
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 0 bytes and written 346 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
---

abu1 · October 1, 2021, 2:25pm

I see. How/where do I make this change? @rg305

Topic		Replies	Views
IdenTrust DST Root CA X3 expiry Help	18	5235	November 6, 2021
Broken links on doc page for DST Root CA X3 Expiration Site Feedback	7	2336	May 9, 2021
Feedback wanted: DST Root CA X3 expiration all-subscriber email Issuance Tech	14	3011	May 6, 2021
Expiration or revokation of DST Root CA X3 Help	4	4035	January 1, 2018
Expiration of DST Root CA X3 and Ingenico POS Help	21	1840	October 24, 2021

Help thread for DST Root CA X3 expiration (September 2021)

Related topics