Hello, After certificate renewal on multiple servers I administer (they have all been fixed manually now, so disclosing them here won't help), I'm still getting expired certificate errors when using tools like curl or wget to download something from those servers. It seems the ACME server is still …

Let's Encrypt currently do use the chain ending in DST Root CA X3 (mainly motivated by compatibility with old Android devices). If you wish to use the modern chain you need to use the --preferred-chain "ISRG Root X1" command line option or set the configuration option in your renewal configuration …

More background here: [image] Long (default) and Short (alternate) Certificate Chains Explained Issuance Policy I…

[image] ddscentral: Since tools like curl and wget aren't as smart as web browsers, they fail when they see the expired root. In addition to what others said above, please consider running your operating system's updates AND/OR updating the operating system itself. The behavior you mentioned…

What is "fairly old" ? Updating the OS isn't always possible, for example I administer some older servers (servers which belong to customers of the company I work for) which run custom-built software which just won't work under newer OS versions without resorting to a ton of workarounds (chroot, LD…

[image] ddscentral: The best I can do For such outdated systems, IMHO, the very best anyone can do (to hyper-extend their life expectancy) is to P2V (virtualize) them. And then put the VM(s) behind proxies (both inbound and outbound).

[image] ddscentral: I have to manually fix the chain.pem and fullchain.pem with correct root CAs. Then you either have an old ACME client OR you aren't getting the most out of your current client. There is an option --preferred-chain that can be used to make that change for you. [image] …

Thanks, I will try that. Unfortunately, I do not own those servers. Majority of them aren't exposed directly to the interweb though, most are behind a VPN and a squid proxy.

[image] ddscentral: The best I can do for those servers without recompiling CURL, OpenSSL, etc. is update the CA repository which usually works fine as long as the host server presents the correct root CA. Most major operating systems have backported the OpenSSL fix, and other affected librar…

[image] ddscentral: Unfortunately, I do not own those servers. But if you can do: [image] ddscentral: I have to manually fix the chain.pem and fullchain.pem with correct root CAs. then you should have enough access to modify certbot renewal settings.

Old ISRG root certificate in chain after renewal

Help

MikeMcQ November 23, 2021, 3:35pm 3

More background here:

Topic		Replies	Views
DST Root CA X3 Expiration Help	15	2970	November 12, 2021
Certbot has been configured to prefer certificate chains with issuer 'ISRG Root X1', but no chain from the CA matched this issuer. Using the default certificate chain instead Help	20	4697	January 9, 2022
Letsencrypt renews certificates incorrectly Help	4	825	February 3, 2022
--preferred-chain not taking effect Help	35	10690	November 17, 2021
Why is LetsEncrypt issuing certificates with the old root Help	3	698	October 7, 2021

Old ISRG root certificate in chain after renewal

Related topics