My domain is: genea.de-brouwerij.be I ran this command: certbot certificates It produced this output: Saving debug log to /var/log/letsencrypt/letsencrypt.log - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Found the following certs: Certificate Name: mailbox.de…

Here, read this: [image] Shortening the Let's Encrypt Chain of Trust API Announcements W…

[image] Koenraad: I searched to try to remove that X3 root, but I can't find where to configure this. Please see the Certbot info for --preferred-chain in the User Guide — Certbot 2.6.0 documentation .

Thanks, your links enabled me to set the preferred chain to ISRG Root X1. Now I don't see complaints in the log of telegraf anymore. But can I also conclude from my readings that telegraf is being holier than the pope ?

[image] Koenraad: But can I also conclude from my readings that telegraf is being holier than the pope ? Could be. Doesn't necessarily need to be Telegraf itself, but e.g. the Go libraries used. Not sure about that.

There is nothing wrong with the long chain that includes DST Root CA X3. In fact this forum uses a cert chain which includes that as do numerous other sites given that it is the default chain. You might want to read this for deeper background [image] Extending Android Device Compatibility…

I got a reply that's not seen here, so I will explain what I did : In /etc/letsencrypt/renewal/mailbox.de-brouwerij.be.conf (the config-file for my certificate) I added a line after the [renewalparams] : preferred_chain = ISRG Root X1 Then I ran certbot renew --force-renewal Now my certificate …

[image] Koenraad: Regarding : nothing wrong with the "old" certificate : try to convince the people from telegraf. I could not Well, it is probably not worth the trouble as the chain with DST Root CA X3 will be going away next year anyway so you have just made the change early. And, plenty o…

[image] Koenraad: I got a reply that's not seen here, so I will explain what I did : In /etc/letsencrypt/renewal/mailbox.de-brouwerij.be.conf (the config-file for my certificate) I added a line after the [renewalparams] : preferred_chain = ISRG Root X1 In the future, please don't manually c…

Telegraf complains certificate is using old root

Help

9peppe August 9, 2023, 9:03am 2

Here, read this:

Topic		Replies	Views
--preferred-chain not taking effect Help	35	10732	November 17, 2021
Certbot has been configured to prefer certificate chains with issuer 'ISRG Root X1', but no chain from the CA matched this issuer. Using the default certificate chain instead Help	20	4740	January 9, 2022
DST Root CA X3 Expiration Help	15	2977	November 12, 2021
Can not connect using ISRG root X1 Issuance Tech	20	2089	August 26, 2021
Invalid certificate chain Help	1	2031	February 14, 2022

Telegraf complains certificate is using old root

Related topics