My domain is: multiple (saicanews.co.za) I ran this command: none It produced this output: none My web server is (include version): Apache 2.4.18 however various servers with different versions The operating system my web server runs on is (include version): Ubuntu server 16.04 and later My hos…

Apologies, not R3 DST Root CA X3 Expiration (September 2021) - Let's Encrypt Update September 30, 2021 As planned, the DST Root CA X3 cross-sign has expired, and we’re now using our own ISRG Root X1 for trust on almost all devices. For more details about the plan, keep reading! We hav…

Hi @machiel and welcome to the LE community forum :slight_smile: [image] machiel: Apologies for my rant I think you are going beyond a "rant" with: [image] machiel: but it is frustrating that a company we trusted for many years refuse to assist When this is your first post about it a…

[image] machiel: We have tried to renew the certificates with new ones, however this does not solve the issue as it is still picking up this chain. If you are to serve the shorter/alternate chain, you must now do one of these four things: manually remove the last cert from the fullchain.pem …

@rg305 Thank you for the solution path. Just as an explanation, we did remove the last cert in the fullchain as well based on an article we found, however as stated this was not a proper fix as it was re-added after the new renewal days later. I will try updating certbot again as this is the vers…

If DST Root CA X3 is being added back in to your chain your ACME client is using the default chain served by Let's Encrypt. As stated by @rg305 you can use the "preferred issuer" feature of your acme client to build a chain to "ISRG Root X1" instead. Your comment that all of Let's Encrypts mails an…

[image] webprofusion: you can use the "preferred issuer" feature of your acme client to build a chain to "ISRG Root X1" instead. I don't think that's an option available for: [image] machiel: using Certbot): 0.31.0

[image] rg305: I don't think that's an option available for Certbot 0.31.0 No, as you noted earlier it needs 1.12 or later But, if they did not want to update Certbot or use a diff client was --deploy-hook available back then - do you know? If they are clever programmers they could use that …

They wouldn't have to go that far. Something I just learned today [how Seinfeldish]: Apache can still use the deprecated SSLCertificateChainFile. So... They could change (the default): SSLCertificateFile /etc/letsencrypt/live/EXAMPLE/fullchain.pem SSLCertificateKeyFile /etc/letsencrypt/l…

@rg305 Very clever. I am going to add your post to my fave tricks collection :slight_smile:

That is precisely how I am doing on CentOS. The module mod_ssl ships the /etc/httpd/conf.d/ssl.conf file. I have only one modification in the file, I change: #SSLCertificateChainFile /etc/pki/tls/certs/server-chain.crt to SSLCertificateChainFile /etc/pki/tls/certs/server-chain.crt I create that …

Why is letsencrypt not fixing DST Root CA X3 issue

Help

griffin October 29, 2021, 11:05pm 13

More information:

Topic		Replies	Views
R3 Intermediate certificate has expired Help	130	40187	October 2, 2021
Help thread for DST Root CA X3 expiration (September 2021) Help	665	172697	December 26, 2021
DST Root CA X3 Expiration Help	15	3038	November 12, 2021
Feedback wanted: DST Root CA X3 expiration all-subscriber email Issuance Tech	13	3255	April 6, 2021
Can some one explain how renewal expiration of R3 works? Help	25	3486	October 1, 2021

Why is letsencrypt not fixing DST Root CA X3 issue

Related topics