I’m getting a certificate error when visiting letsencrypt.org using my Chrome and Safari on my Mac. It’s working fine using Firefox, and command line curl (using anaconda3).
The same error has been observed on other sites having LE certificates (https://www.finn.no/ being amongst them).
However, there are many sites having LE certificates that works just fine (from both Chrome and Safari, on the same Mac), for example https://fn.is/ .
The strange part is that, on a site that complains about bad certificate, if I bypass the warning, and inspect the certificate chain, it looks just fine (i.e. it says “This certificate is valid” for both root, intermediate and issued).
To clarify; this used to work just fine, and has happened during the last couple of weeks (I’ve been traveling a bit, so have not noticed before now), without any (relevant) changes on my computer (that I know of).
@JuergenAuer, see below. It seems to be the correct chain (after copying them into three separate files, and inspecting them via openssl).
@stevenzhu, I’m using Mac OS 10.14.6 with all security updates. I can see the (valid) root cert in my “System Roots” in Keychain.
Also keep in mind that this worked just fine a couple of weeks ago. My first thought was wrong time on local machine (since I’ve been traveling multiple timezones), but that is not the case (and would not explain why it worked in Firefox).
@rg305, I already did that; look at screenshot in first post, showing valid certificate chain for letsencrypt.org (i.e. all certificates are marked with “This certificate is valid”). It still complains (-:
Even if it was OCSP, it would not explain why “letsencrypt.org” does NOT work, while “community.letsencrypt.org” works, from the SAME browser, on the SAME machine.
I found some more interesting info now, as Safari actually lets you preview the certificate before “loading” the page. It says “letsencrypt.org certificate is not standards compliant”, whatever that means.
@rg305, I’m thinking it might be related to this update; https://support.apple.com/en-us/HT210176 (and somehow it was backported to 10.14 as well, without explicitly stating so in any of the 10.14 security updates).
edit: Root is actually SHA-1, but intermediate (issuing CA) is SHA-2. The “Apple defined rule” as per the list above, only states “issuing CA”, so I guess root CAs are not counted, depending on how one looks at it?
The id-kp-serverAuth OID is present (1.3.6.1.5.5.7.3.1 = “Server Authentication”).
It seems,
The community cert was issued on Jan 21; while the LE.org cert was issued on March 7.
So it seems something changed (is now being enforced) between those two dates.
@9peppe, the OCSP-config for them is equal, though. Could be server config related, but it seems somewhat random so far. I'm about to try enforce same ciphers on a server that has working LE certificates, to use the same as a non-working one, to see if it's related to that.
That or a combination of that and SSL-config on server.
Except it's the same on the working vs. non-working certificate;
