Isrg-root-x1-cross-signed.pem has expired

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: misterprotocol.photos

I ran this command: certbot certonly

It produced this output: The usual

My web server is (include version): None

The operating system my web server runs on is (include version): Macos Sequoia 15.2

My hosting provider, if applicable, is:

I can login to a root shell on my machine (yes or no, or I don't know): Yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): No

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): None

I'm not running a web server. I'm using Let's Encrypt certs to encrypt an FTPS server in FileZilla Server. Why? Because I'm using Sony and Canon cameras to send pictures back to my FTP server, I want to use encryption, and the cameras have support for FTPS and that's all.

To do this, you have to install root certificates on the cameras. Some sort of problem with FileZilla Server prevents me from just generating and using my own root cert and certificate, so I decided to use Let's Encrypt, since FileZilla Server has support for generating and using a Let's Encrypt certificate. However, at least on my Canon camera, when I downloaded what I assumed to be the correct root cert for my freshly-generated certificate, and tried to load it into the camera, the camera said "This root certificate may be expired", and refused to load it. Sure enough, printing out the root cert shows a "Not After" date of last September. How do I fix this?

The cross-signed version of ISRG Root X1 (signed by DST Root CA X3) indeed expired in September. It has been retired for quite a while now. The root certificate you're looking for is the self-signed version of ISRG Root X1: https://letsencrypt.org/certs/isrgrootx1.pem

5 Likes

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.