Hi, I have some problem with my ssl certificate that started today. My certificate were not due for renewal but for some reason when a service like axios try to do a post on my server, i get a 'CERT_HAS_EXPIRED' error. I did force renew my certificate to be sure but i still have the same problem. I…

[image] epoirier: I'm trying to changing my configuration but I get the following error [image] Phil: You can make that change manually by editing the chain file used by your webserver. Simply edit the fullchain.pem file and remove the last certificate.

Hi @epoirier , Here's the certificate chain you're serving which needs to change. $ openssl s_client -connect admin.netsign.tv:443 -servername admin.netsign.tv CONNECTED(00000003) depth=2 C = US, O = Internet Security Research Group, CN = ISRG Root X1 verify return:1 depth=1 C = US, O = Let's Encry…

Thank you for your help, I'm trying to changing my configuration but I get the following error : certbot: error: unrecognized arguments: --preferred-chain ISRG Root X1 I'm on ubuntu 18 and I do not seem to be able to upgrade further than certbot 0.31.0

Thank you for your help, after removing the last certificate from my fullchain, my problems were solved. I just hope that when the certificate is renewed it will not add the faulty certificate to my fullchain again.

[image] epoirier: I just hope that when the certificate is renewed it will not add the faulty certificate to my fullchain again. Oh, but it will - Happy Holloween! - LOL [I'm sure there is much more to be said, and done, about this topic in the (<90) days to come]

[image] epoirier: I just hope that when the certificate is renewed it will not add the faulty certificate to my fullchain again. It most likely will. However, hopefully by then clients will stop trying to validate the chain up to the expired DST Root CA X3. Maybe due to the fact that root has…

[image] Phil: (i.e. just remove the cross-signed ISRG Root X1 from the chain), I suspect that your client(s) will begin to trust your server again. [image] rg305: Simply edit the fullchain.pem file and remove the last certificate. Thank you very much for your advice! I want to add tha…

[image] Osiris: [image] epoirier: I just hope that when the certificate is renewed it will not add the faulty certificate to my fullchain again. It most likely will. However, hopefully by then clients will stop trying to validate the chain up to the expired DST Root CA X3. Maybe due to th…

This simple hint was the only thing that worked for me, thanks @rg305

Hi @vsi welcome to the LE community :slight_smile: I'm glad to have made it simple for you.

When I run the command 'openssl s_client -connect example.com:443 -servername example.com ' I see what needs to be changed, but I can't edit on screen... the pem file /etc/letsencrypt/live/example.com/ fullchain.pem does not have the same content to delete and save with VIM or NANO... Which Ubuntu wa…

Problem with certificate has expired

Help

rg305 September 30, 2021, 6:42pm 4

Simply edit the fullchain.pem file and remove the last certificate.

Topic		Replies	Views
Rate limited: Error creating new order :: too many certificates (5) already issued for this exact set of domains Help	68	5480	November 8, 2021
R3 Intermediate certificate has expired Help	133	36881	November 1, 2021
Unclear motive for negative server responses Help	57	5108	November 28, 2021
[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed Help	11	5613	February 20, 2022
Cert Renew OK, HTTPS NOT! Help	19	1170	May 19, 2019

Problem with certificate has expired

Related topics