RHEL/CentOS 6 OpenSSL client compatibility after DST Root CA X3 expiration

At least this is not problematic for OpenSSL, which ignores the (now broken) self-signature.
Other applications & libraries should be able to anchor any LE chain to ISRG Root X1 directly, ignoring DST Root CA X3 completely (either because it's expired or corrupted), this was an OpenSSL-specific issue.

4 Likes