HTTPS certificate not valid after DST Root CA X3 expiration

[farang1991]

@Nummer378

The certificate found in /opt/bitnami/apache2/conf/ is only valid for the hostname promis2.laophenixconsulting.com . It is currently valid and not expired. Based on the directory, I would say that is bitnami's acme client?

Yes It is.

@Nummer378

What to do depends on what you want to achieve:

• Which hostnames do you have, want or need certificates for?
• Which acme client do you want to use to get the certificates?

I just need certificate for my subdomain (promis2.laophenixconsulting.com)
For my acme client I want to stay with the one located in /opt/bitnami/letsencrypt/accounts

@Nummer378

This is not correct, you usually do not need the SSLCertificateChainFile directive at all (Apache is capable of loading leaf + chain from SSLCertificateFile ). If it is used, it must not be used with any fullchain.

So according to that I understand, I should have this configuration:

  SSLEngine on
  SSLCertificateFile "/opt/bitnami/apache2/conf/promis2.laophenixconsulting.com.crt"
  SSLCertificateKeyFile "/opt/bitnami/apache2/conf/promis2.laophenixconsulting.com.key"

That's why some devices keep using the DST Root CA X3 ?