Hi i am using centos server and upgrading ssl in nginx with --preferred-chain "ISRG Root X1" Still i am facing DST Root CA X3 issues in my urls,please help and suggest something effective asap!!

Hi @Gagan welcome to the LE community forum :slight_smile: Please provide the FQDN having this issue so we may better understand the problem first hand and give you our best advice. Also show the nginx HTTPS vhost config that covers that FQDN.

url - old-nginx.capuchin.co renewal conf # renew_before_expiry = 30 days version = 1.11.0 archive_dir = /etc/letsencrypt/archive/old-nginx.capuchin.co cert = /etc/letsencrypt/live/old-nginx.capuchin.co/cert.pem privkey = /etc/letsencrypt/live/old-nginx.capuchin.co/privkey.pem chain = /etc/letsencr…

@Gagan That is the certbot renewal.conf file. [image] rg305: Also show the nginx HTTPS vhost config that covers that FQDN.

server { listen 80; server_name old-nginx.capuchin.co; rewrite ^ [https://$http_host$request_uri](https://$http_host$request_uri/)? permanent; } server{ listen 443 ssl http2; server_name old-nginx.capuchin.co; root /var/www/html/index.html; ## ssl on; ssl_certificate /etc/letsencrypt/live/old-nginx.…

[image] Gagan: preferred_chain = ISRG Root X1 That doesn't seem to have taken effect: openssl s_client -connect old-nginx.capuchin.co:443 -servername old-nginx.capuchin.co CONNECTED(00000005) depth=2 C = US, O = Internet Security Research Group, CN = ISRG Root X1 verify return:1 depth=1 C = …

@Gagan Look into what? Please use more words

[image] Gagan: version = 1.11.0 That certbot is too old to have the preferred-chain option. Please update it to 1.12.0 or newer.

[image] Osiris: That certbot is too old to have the preferred-chain option. Please update it to 1.12.0 or newer. They seem to be using CentOS, this may be relevant regarding the outdated certbot version: RHEL/CentOS 7 OpenSSL client compatibility after new chain - #37 by FelixSchwarz

Hi team, --preferred-chain "ISRG Root X1 is working fine with nginx, url not working when renewing it on apache.please suggest something asap , this is a production issue.

Nginx with preferred-chain "ISRG Root X1" - still showing "DST Root CA X3" - #7 by rg305 - Help

Topic		Replies	Views	Activity
Nginx - certbot - chain not updating Help	26	2659	October 7, 2021
--preferred-chain not taking effect Help	35	10805	November 17, 2021
DST Root CA certificate not yet valid - Fixed Help	5	875	August 19, 2022
What is the chain to pass to --preferred-chain argument to keep using DST Root X3 root certificate? Help	31	13857	November 11, 2020
Certbot 1.12+ which supports --preferred-chain in OS packages Help	8	4623	October 12, 2021