Previously I was having no trouble generating certs using Certbot for Nextcloud, and then for iOS and macOS calendars. However, it now seems that the certs are no longer accepted, since I get "Cannot Connect Using SSL".
Apparently the certificate requirements have changed, however I already inspected the details of the cert and everything seems to be fine.
openssl reports verify error:num=10:certificate has expired, but the browser (for example) doesn't complain about the certs...
Can anyone help? Thanks in advance
My domain is: nextcloud.jcrooke.net
I ran this command: openssl s_client -showcerts -connect nexcloud.jcrooke.net:443 2>&1
It produced this output:
depth=1 O = Digital Signature Trust Co., CN = DST Root CA X3
verify error:num=10:certificate has expired
notAfter=Sep 30 14:01:15 2021 GMT
verify return:0
depth=1 O = Digital Signature Trust Co., CN = DST Root CA X3
verify error:num=10:certificate has expired
notAfter=Sep 30 14:01:15 2021 GMT
verify return:0
depth=3 O = Digital Signature Trust Co., CN = DST Root CA X3
verify error:num=10:certificate has expired
notAfter=Sep 30 14:01:15 2021 GMT
verify return:0
CONNECTED(00000005)
---
Certificate chain
0 s:/CN=jcrooke.net
i:/C=US/O=Let's Encrypt/CN=R3
-----BEGIN CERTIFICATE-----
MIIFKjCCBBKgAwIBAgISA2wMGPwfeGxbASP/3aZBCCAZMA0GCSqGSIb3DQEBCwUA
MDIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQswCQYDVQQD
EwJSMzAeFw0yMTA5MTQyMjUyMTRaFw0yMTEyMTMyMjUyMTNaMBYxFDASBgNVBAMT
C2pjcm9va2UubmV0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAoq07
QICZ0dpcv8ZudTC4GAVUw0A37Mzaz/13ySnfVrPsm/nN5+3/05uSqomGdikVAaI3
0KJg0Yo9kcUDMyulia9KOONSvqHdAdGrYv8M/qDtGiWsS9v8ybNgIRDAC3dbyEBZ
vDYw0yWzlJks5ZpDzg3GrGIiFZL4QP0sgOV4Ag4b+uRSsAnSFHX4uAF5G929xy6X
FNM8CeEfj5IeRX5I6d31BtWAmU6cBXfU4Z5CuylUkfQvBATcxeUIeQ6r5tzgKME5
17pUeA1T7gd0EDxpNxX4smMnQZRZT3fJW/AdV0OYOAP/sZSLWRifiZ9q2VjO+aiV
MYuR1u3YRNsGLuMjAQIDAQABo4ICVDCCAlAwDgYDVR0PAQH/BAQDAgWgMB0GA1Ud
JQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAMBgNVHRMBAf8EAjAAMB0GA1UdDgQW
BBSq1htY2NUZipbzwGHSNlmjXBzzSzAfBgNVHSMEGDAWgBQULrMXt1hWy65QCUDm
H6+dixTCxjBVBggrBgEFBQcBAQRJMEcwIQYIKwYBBQUHMAGGFWh0dHA6Ly9yMy5v
LmxlbmNyLm9yZzAiBggrBgEFBQcwAoYWaHR0cDovL3IzLmkubGVuY3Iub3JnLzAl
BgNVHREEHjAcgg0qLmpjcm9va2UubmV0ggtqY3Jvb2tlLm5ldDBMBgNVHSAERTBD
MAgGBmeBDAECATA3BgsrBgEEAYLfEwEBATAoMCYGCCsGAQUFBwIBFhpodHRwOi8v
Y3BzLmxldHNlbmNyeXB0Lm9yZzCCAQMGCisGAQQB1nkCBAIEgfQEgfEA7wB2AH0+
8viP/4hVaCTCwMqeUol5K8UOeAl/LmqXaJl+IvDXAAABe+a5s3YAAAQDAEcwRQIg
Bx1lGVJrPrFEJCoK051WnAWKc+XMZDrS23Jj8xWvP7oCIQCqROvhawBrCpFoqHPp
dl6QhoDXUwYs5WONClBarBJNgQB1AESUZS6w7s6vxEAH2Kj+KMDa5oK+2MsxtT/T
M5a1toGoAAABe+a5tUIAAAQDAEYwRAIgAqJya0dRUpcuufcfyqWEntPYen3DeUPG
KKyeUvOH1NkCIFfsF61sZQMwJBoFVN+VXJqlU2zdgtsbPUZRDmm5zMpGMA0GCSqG
SIb3DQEBCwUAA4IBAQChShaa0fMxE2Bnv250jhHqe9e4P7ooD4V+SmPiS5gaE/Jl
d68f+84X3wR6HeqcZ+Zw9lzAMbXO7RDrUZtUG1/rf6CXpUcAm9GLPyml4ejKCQDn
I/0fcYkOI6rErdqyE6U6vRy/jx6n+YGekSHmuCge5lsseUo/Lp1jBaWKjWeU5Nlh
yaMyg/0ps4vDR00pSYjEN1ZMt/FWekWRyMQIISXlY2IB2X3rM7eK6nX2rsIM0/Cl
rTeCZBroZK1xOWuh/ST5paD+Qc4+eYtjfrMOdJVlFWcPhx7rPqKJYnh3B5+BmfPN
9mwhj+ELbv45747roVfQKx4dO9k4lRj/vis48eDP
-----END CERTIFICATE-----
1 s:/C=US/O=Let's Encrypt/CN=R3
i:/C=US/O=Internet Security Research Group/CN=ISRG Root X1
-----BEGIN CERTIFICATE-----
MIIFFjCCAv6gAwIBAgIRAJErCErPDBinU/bWLiWnX1owDQYJKoZIhvcNAQELBQAw
TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh
cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMjAwOTA0MDAwMDAw
WhcNMjUwOTE1MTYwMDAwWjAyMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3Mg
RW5jcnlwdDELMAkGA1UEAxMCUjMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
AoIBAQC7AhUozPaglNMPEuyNVZLD+ILxmaZ6QoinXSaqtSu5xUyxr45r+XXIo9cP
R5QUVTVXjJ6oojkZ9YI8QqlObvU7wy7bjcCwXPNZOOftz2nwWgsbvsCUJCWH+jdx
sxPnHKzhm+/b5DtFUkWWqcFTzjTIUu61ru2P3mBw4qVUq7ZtDpelQDRrK9O8Zutm
NHz6a4uPVymZ+DAXXbpyb/uBxa3Shlg9F8fnCbvxK/eG3MHacV3URuPMrSXBiLxg
Z3Vms/EY96Jc5lP/Ooi2R6X/ExjqmAl3P51T+c8B5fWmcBcUr2Ok/5mzk53cU6cG
/kiFHaFpriV1uxPMUgP17VGhi9sVAgMBAAGjggEIMIIBBDAOBgNVHQ8BAf8EBAMC
AYYwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMBMBIGA1UdEwEB/wQIMAYB
Af8CAQAwHQYDVR0OBBYEFBQusxe3WFbLrlAJQOYfr52LFMLGMB8GA1UdIwQYMBaA
FHm0WeZ7tuXkAXOACIjIGlj26ZtuMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcw
AoYWaHR0cDovL3gxLmkubGVuY3Iub3JnLzAnBgNVHR8EIDAeMBygGqAYhhZodHRw
Oi8veDEuYy5sZW5jci5vcmcvMCIGA1UdIAQbMBkwCAYGZ4EMAQIBMA0GCysGAQQB
gt8TAQEBMA0GCSqGSIb3DQEBCwUAA4ICAQCFyk5HPqP3hUSFvNVneLKYY611TR6W
PTNlclQtgaDqw+34IL9fzLdwALduO/ZelN7kIJ+m74uyA+eitRY8kc607TkC53wl
ikfmZW4/RvTZ8M6UK+5UzhK8jCdLuMGYL6KvzXGRSgi3yLgjewQtCPkIVz6D2QQz
CkcheAmCJ8MqyJu5zlzyZMjAvnnAT45tRAxekrsu94sQ4egdRCnbWSDtY7kh+BIm
lJNXoB1lBMEKIq4QDUOXoRgffuDghje1WrG9ML+Hbisq/yFOGwXD9RiX8F6sw6W4
avAuvDszue5L3sz85K+EC4Y/wFVDNvZo4TYXao6Z0f+lQKc0t8DQYzk1OXVu8rp2
yJMC6alLbBfODALZvYH7n7do1AZls4I9d1P4jnkDrQoxB3UqQ9hVl3LEKQ73xF1O
yK5GhDDX8oVfGKF5u+decIsH4YaTw7mP3GFxJSqv3+0lUFJoi5Lc5da149p90Ids
hCExroL1+7mryIkXPeFM5TgO9r0rvZaBFOvV2z0gp35Z0+L4WPlbuEjN/lxPFin+
HlUjr8gRsI3qfJOQFy/9rKIJR0Y/8Omwt/8oTWgy1mdeHmmjk7j1nYsvC9JSQ6Zv
MldlTTKB3zhThV1+XWYp6rjd5JW1zbVWEkLNxE7GJThEUG3szgBVGP7pSWTUTsqX
nLRbwHOoq7hHwg==
-----END CERTIFICATE-----
2 s:/C=US/O=Internet Security Research Group/CN=ISRG Root X1
i:/O=Digital Signature Trust Co./CN=DST Root CA X3
-----BEGIN CERTIFICATE-----
MIIFYDCCBEigAwIBAgIQQAF3ITfU6UK47naqPGQKtzANBgkqhkiG9w0BAQsFADA/
MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT
DkRTVCBSb290IENBIFgzMB4XDTIxMDEyMDE5MTQwM1oXDTI0MDkzMDE4MTQwM1ow
TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh
cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwggIiMA0GCSqGSIb3DQEB
AQUAA4ICDwAwggIKAoICAQCt6CRz9BQ385ueK1coHIe+3LffOJCMbjzmV6B493XC
ov71am72AE8o295ohmxEk7axY/0UEmu/H9LqMZshftEzPLpI9d1537O4/xLxIZpL
wYqGcWlKZmZsj348cL+tKSIG8+TA5oCu4kuPt5l+lAOf00eXfJlII1PoOK5PCm+D
LtFJV4yAdLbaL9A4jXsDcCEbdfIwPPqPrt3aY6vrFk/CjhFLfs8L6P+1dy70sntK
4EwSJQxwjQMpoOFTJOwT2e4ZvxCzSow/iaNhUd6shweU9GNx7C7ib1uYgeGJXDR5
bHbvO5BieebbpJovJsXQEOEO3tkQjhb7t/eo98flAgeYjzYIlefiN5YNNnWe+w5y
sR2bvAP5SQXYgd0FtCrWQemsAXaVCg/Y39W9Eh81LygXbNKYwagJZHduRze6zqxZ
Xmidf3LWicUGQSk+WT7dJvUkyRGnWqNMQB9GoZm1pzpRboY7nn1ypxIFeFntPlF4
FQsDj43QLwWyPntKHEtzBRL8xurgUBN8Q5N0s8p0544fAQjQMNRbcTa0B7rBMDBc
SLeCO5imfWCKoqMpgsy6vYMEG6KDA0Gh1gXxG8K28Kh8hjtGqEgqiNx2mna/H2ql
PRmP6zjzZN7IKw0KKP/32+IVQtQi0Cdd4Xn+GOdwiK1O5tmLOsbdJ1Fu/7xk9TND
TwIDAQABo4IBRjCCAUIwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYw
SwYIKwYBBQUHAQEEPzA9MDsGCCsGAQUFBzAChi9odHRwOi8vYXBwcy5pZGVudHJ1
c3QuY29tL3Jvb3RzL2RzdHJvb3RjYXgzLnA3YzAfBgNVHSMEGDAWgBTEp7Gkeyxx
+tvhS5B1/8QVYIWJEDBUBgNVHSAETTBLMAgGBmeBDAECATA/BgsrBgEEAYLfEwEB
ATAwMC4GCCsGAQUFBwIBFiJodHRwOi8vY3BzLnJvb3QteDEubGV0c2VuY3J5cHQu
b3JnMDwGA1UdHwQ1MDMwMaAvoC2GK2h0dHA6Ly9jcmwuaWRlbnRydXN0LmNvbS9E
U1RST09UQ0FYM0NSTC5jcmwwHQYDVR0OBBYEFHm0WeZ7tuXkAXOACIjIGlj26Ztu
MA0GCSqGSIb3DQEBCwUAA4IBAQAKcwBslm7/DlLQrt2M51oGrS+o44+/yQoDFVDC
5WxCu2+b9LRPwkSICHXM6webFGJueN7sJ7o5XPWioW5WlHAQU7G75K/QosMrAdSW
9MUgNTP52GE24HGNtLi1qoJFlcDyqSMo59ahy2cI2qBDLKobkx/J3vWraV0T9VuG
WCLKTVXkcGdtwlfFRjlBz4pYg1htmf5X6DYO8A4jqv2Il9DjXA6USbW1FzXSLr9O
he8Y4IWS6wY7bCkjCWDcRQJMEhg76fsO3txE+FiYruq9RUWhiF1myv4Q6W+CyBFC
Dfvp7OOGAN6dEOM4+qR9sdjoSYKEBpsr6GtPAQw4dy753ec5
-----END CERTIFICATE-----
---
Server certificate
subject=/CN=jcrooke.net
issuer=/C=US/O=Let's Encrypt/CN=R3
---
No client certificate CA names sent
Server Temp Key: ECDH, X25519, 253 bits
---
SSL handshake has read 4663 bytes and written 281 bytes
---
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-CHACHA20-POLY1305
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
Protocol : TLSv1.2
Cipher : ECDHE-RSA-CHACHA20-POLY1305
Session-ID: 4A1ADBD8FFE8DE7EBB9EF863479A515FB1359E4285477D63D4B12167E06FA47C
Session-ID-ctx:
Master-Key: 6451E7E0DEBBABD871390C913260B0F748A2A70DC0DE417DE0225F8C55E8CED9A9C9E40BF576BABE3DEB452D06360D0D
TLS session ticket lifetime hint: 300 (seconds)
TLS session ticket:
0000 - c9 89 ab 28 76 ea 9a 40-bd 8c 8d 62 c4 88 33 e6 ...(v..@...b..3.
0010 - b8 d1 f5 ec 81 a9 28 4e-b1 48 53 9d a5 51 26 54 ......(N.HS..Q&T
0020 - cf 39 86 de 87 61 97 a0-45 35 a1 fc e0 5f 0f 81 .9...a..E5..._..
0030 - 23 c6 02 3e 71 dc bb 7e-c8 61 bc 78 53 66 73 19 #..>q..~.a.xSfs.
0040 - c0 04 c3 73 c9 22 80 98-fe 8d 87 8e 62 12 e5 d8 ...s."......b...
0050 - d0 c5 2b a0 0b b4 77 28-ef 08 03 25 3b 10 da 48 ..+...w(...%;..H
0060 - 35 f0 f4 3a ee 99 d8 7c-bc 9a 7d 70 f9 ee 39 5c 5..:...|..}p..9\
0070 - db b8 b8 0b 41 67 d7 04-44 05 d4 8a d9 18 4c d2 ....Ag..D.....L.
0080 - f5 da d3 28 e3 db 0a 8b-6b 46 86 27 c1 69 04 0c ...(....kF.'.i..
0090 - 55 44 61 4c ca c4 a1 1b-7a bb 39 fb 93 fc d4 97 UDaL....z.9.....
00a0 - 9c 2f 26 b3 60 14 a1 eb-7f e1 33 4b 97 a2 d5 d0 ./&.`.....3K....
00b0 - c4 2c aa 97 6f 0a 1f 63-56 c1 f7 be 6b 82 ac 33 .,..o..cV...k..3
Start Time: 1635671645
Timeout : 7200 (sec)
Verify return code: 0 (ok)
---
closed
My web server is (include version):
Server version: Apache/2.4.38 (Debian)
Server built: 2021-06-10T10:13:06
The operating system my web server runs on is (include version):
Host:
NAME="CentOS Stream"
VERSION="8"
ID="centos"
ID_LIKE="rhel fedora"
VERSION_ID="8"
PLATFORM_ID="platform:el8"
PRETTY_NAME="CentOS Stream 8"
ANSI_COLOR="0;31"
CPE_NAME="cpe:/o:centos:centos:8"
HOME_URL="https://centos.org/"
BUG_REPORT_URL="https://bugzilla.redhat.com/"
REDHAT_SUPPORT_PRODUCT="Red Hat Enterprise Linux 8"
REDHAT_SUPPORT_PRODUCT_VERSION="CentOS Stream"
Apache container:
PRETTY_NAME="Debian GNU/Linux 10 (buster)"
NAME="Debian GNU/Linux"
VERSION_ID="10"
VERSION="10 (buster)"
VERSION_CODENAME=buster
ID=debian
HOME_URL="https://www.debian.org/"
SUPPORT_URL="https://www.debian.org/support"
BUG_REPORT_URL="https://bugs.debian.org/"
My hosting provider, if applicable, is: n/a
I can login to a root shell on my machine (yes or no, or I don't know): Yes
I'm using a control panel to manage my site (no, or provide the name and version of the control panel): no
The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): certbot 1.20.0
]