Hi, I have an emby server running on an ubuntu 20.04 server with a letsencrypt ssl certificate. It runs for years without problems, but since the expiration of the R3 certificate my android devices can't connect anymore. I used certbot to generate a new certificate with the following command: sud…

I think i resolved the problem: https://emby.media/community/index.php?/topic/102125-lets-encrypt-expired-intermediate-and-dotnet-caching/ I did: sudo rm /var/lib/emby/.dotnet/corefx/cryptography/x509stores/ca/*.pfx sudo service emby-server restart Now it's the good Certificate #2 [image] An…

I'm not sure if it'll make any difference, but that's what @Ted meant I think indeed. The same files will be included in the PFX, but probably just in a different order. I also saw that the pkcs12 function has a -chain option, so maybe you need to feed it cert.pem using -in and feed it chain.pem u…

[image] Osiris: Also, it's very weird: if the PFX does not contain the already expired R3-signed-by -DST Root CA X3, where did it come from? Does Emby have it cached somewhere? It didn't come from the PFX you've shown.. I have absolutly no idea.

I'm afraid i'm a bit lost.. If i sumirize well the situation: My .pem certificates (fullchain.pem, privkey.pem) are good My .pfx is good (does not contain the already expired R3-signed-by -DST Root CA X3) The expired R3-signed-by -DST Root CA X3 comes from somewhere else

@TuXFire I'm more than happy to walk through all that to confirm it and help figure out where the problem is with you. In order for me to do that, I would need: the FQDN that is serving the .pem/.pfx files a picture of the error message (pictures paint a thousand words) any relevant details abou…

@rg305 In fact I'm administrating 2 servers with the same configuration (ubuntu 20.04 server running emby, with a let's encrypt certificate) facing the same issue. the FQDN of the 2 servers are valthorens59.ddns.net & tuxfire.ddns.net It worked flawlessly for years but since the expiration of…

[image] rg305: a picture of the error message (pictures paint a thousand words) [image]

@TuXFire Something has gone terribly wrong: openssl s_client -connect tuxfire.ddns.net:443 -servername tuxfire.ddns.net CONNECTED(00000005) depth=1 C = US, O = Let's Encrypt, CN = R3 verify error:num=20:unable to get local issuer certificate --- Certificate chain 0 s:CN = tuxfire.ddns.net i:C …

[image] rg305: That path hasn't been provided since May 2021. I suspect that your renewal process, or web service, may have hard-coded chain information in it. [hard-coding anything of this nature is destined for failure] Let's have a look at the web servers' HTTPS vhost config for the FQDNs …

This seems up-to-date [image] TuXFire: /opt/emby-server/lib/libssl.so.1.1 This might not be: [image] TuXFire: /opt/emby-server/etc/ssl/certs/ca-certificates.crt Either look for an update/verify it is up-to-date OR maybe you can upload this file and we can check on how to manually alt…

[image] rg305: Either look for an update/verify it is up-to-date OR maybe you can upload this file and we can check on how to manually alter it. ca-certificates.crt.txt (196.9 KB)

Problem with R3 expired

Help

TuXFire October 4, 2021, 9:55am 21

Topic		Replies	Views
Still getting R3 certificates Help	24	2207	December 30, 2021
R3 Intermediate certificate has expired Help	130	39049	October 2, 2021
Users of older Android and Windows 7 not able to access website Help	25	11027	November 2, 2021
Unclear motive for negative server responses Help	56	5436	October 29, 2021
C++ Client Library no longer working with Lets Encrypt Help	51	1679	April 11, 2024

Problem with R3 expired

Related topics