My domain is: crt.sh | 6401694660 My web server is: Apache 2.4.51 The operating system my web server runs on is: openSUSE 15.3 I can login to a root shell on my machine: Yes I'm using a control panel to manage my site: No The version of my client is: python2-certbot-1.4.0 This certificate has …

[image] archie172: why did Windows fail to validate the certificate in the first place when ISRG Root X1 was in fullchain.pem and in the Windows certificate store? This may help... [image] Fixing Windows installs that don't receive updates to their trusted roots Help …

Thanks. In this case, the Windows machine has the updated root already. That's what makes the failure mysterious.

When a windows machine doesn't trust a perfectly good certificate the answer is usually either: the machine is not receiving windows updates or it's has firewall blocks preventing basic certificate updates. group policy is set to prevent CA certificate updates (a common problem caused by a bug yea…

The problem is possibly the R3 intermediate. You should have the R3 "Issued By" ISRG Root X1 under Intermediate Certification Authorities, which then chains up to ISRG Root X1 (Issued by ISRG Root X1). Yes, it looks like we are sending the correct R3 - i.e., the one signed by ISRG Root X1. The …

[image] webprofusion: the corresponding R3 There is only one R3 certificate issued by ISRG Root X1, since the public key is the same in both ISRG Root X1 certificates (self signed and cross signed) There's also an R3 certificate issued directly from DST Root X3, and that might be a problem -…

There is only one R3 certificate issued by ISRG Root X1, since the public key is the same in both ISRG Root X1 certificates (self signed and cross signed) Correct - but one hypothesis (for which I have only circumstantial evidence of so far) is that Windows may have a bug where when it checks whe…

The public key in both R3 certificates is the same. But the signature is different. The ISRG Root X1 signature will validate, the DST Root X3 won't. But R3-signed-by-DST hasn't been around in a while. I don't know if that's the issue.

[image] Giuseppe C.: There is only one R3 certificate issued by ISRG Root X1 @9peppe Thanks yep, you're absolutely correct, I'm getting it mixed up with the old one (which from memory was actually newer than the new one, lol). @archie172 regarding which chain you are serving via apache - wi…

Windows: invalid cert when fullchain.pem ISRG Root X1 is cross-signed by expired DST Root CA X3?

Help

Rip May 3, 2022, 5:20pm 2

This may help...

Topic		Replies	Views
Certificate invalid for some clients Help	4	939	November 3, 2021
Should I add both DST Root CA X3 and ISRG Root X1 intermediates? Server	22	12683	August 7, 2018
Authentication Failed with cross-signed ISRG Root X1 on Windows Server Help	9	1499	October 7, 2021
Command to generate ISRG Root X1 certificate Help	4	2751	September 28, 2021
LetsEncrypt test sites show invalid certificate on Server OS Help	4	3001	May 18, 2018

Windows: invalid cert when fullchain.pem ISRG Root X1 is cross-signed by expired DST Root CA X3?

Related topics