Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com ), so withholding your domain name here does not increase secrecy, but …

SOLVED! Had to add the "preferred-chain="ISRG Root X1" directive to cli.ini. Lets Encrypt was defaulting to the old defective chain.

I'm not sure what you mean. I think certbot is working. It's only used in short bursts when Certbot runs, correct? As I said, I thought the openssl command would verify if their domain was running (tls) correctly.

[image] hraycrum69: As I said, I thought the openssl command would verify if their domain was running (tls) correctly. Yes, but why would you care if us-east-va.sip.flowroute.com was running their TLS correctly, if you're having trouble with your own domain? I'm just confused and I don't kno…

Neither site is demonstrating success with offering certificates from SSL Server Test (Powered by Qualys SSL Labs) SSL Server Test: mymachine.twilightparadox.com (Powered by Qualys SSL Labs) SSL Server Test: us-east-va.sip.flowroute.com (Powered by Qualys SSL Labs) Yet both have valid certificate…

Let me start over. I'm trying to establish a tls connection to us-east-va.sip.flowroute.com and get the error "certificate expired" and the connection fails. I get a tls connection to the telnyx server just fine. I keep getting snippets about the change(s) made by LetsEncrypt last year that could b…

[image] hraycrum69: I'm trying to establish a tls connection to us-east-va.sip.flowroute.com and get the error "certificate expired" and the connection fails. But your first post shows an "Connection timed out" error? Also, I can't connect to it either, the host seems to be down. That makes d…

Possible this [image] Long (default) and Short (alternate) Certificate Chains Explained Issuance Policy I… or even this [image] Choice of default long chain vs short chain Issuance Policy I… May be of assistance.

I believe you are correct about mymachine. It's only used for outbound (a client?) Not configured as a server ?

How are you connecting? What OS? What Client and/or Server? Is this on your local LAN or accessible to the Internet at large?

Doesn't seem to be responding on Port 80 (http) nor Port 443 (https) [image] [image] But is Pingable [image]

Debian 10.12, Client? Asterisk / snap / certbot, Asterisk (the mymachine domain) is on my local lan but the domain is supplied by FreeDNS

Using Asterisk as a TLS client

Help

Bruce5051 September 17, 2022, 7:54pm 11

Possible this

or even this

May be of assistance.

Topic		Replies	Views
How do I tell if I have the Long or Short Chain? Help	29	1757	November 4, 2022
Understanding DST Root expiry and the older default cert chain Help	36	3704	December 8, 2021
CN=DST Root CA X3, O=Digital Signature Trust Co. and serial number 4001 7721 37D4 E942 B8EE 76AA 3C64 0AB7 is not a trusted certificate Help	33	8226	November 19, 2021
Issue - Unable to verify certificate chain - CentOS7 Help	34	4703	August 6, 2022
Problem with certificate has expired Help	28	25717	November 5, 2021

Using Asterisk as a TLS client

Related topics