Join Log in
Score:1
avatar Server

Why does Chrome on Windows 7 still display the old root certificate?

gb flag
MirrorMirror

Early this morning, I updated (with win-acme) the web server's (IIS 8.5) SSL certificate due to the known problem of Let's Encrypt with the expiration of the its root certificate (DST Root CA X3). So almost everything is fine and dandy with the new one: Firefox in Win XP 3 SP3, every browser in Windows 10 and Firefox on Windows 7.

However Chrome on Windows 7 shows the old one (DST Root CA X3) instead of the new one. I did clear the SSL state but nothing, still the old expired ones. Chrome is fully updated: Version 94.0.4606.61 (Official Build) (64-bit)

Why is this happening? From reading around, this wasn't supposed to happen with Windows 7, and that the problematic OS would be Win XP less than SP3. Plus, why does Firefox on Windows 7 does not have this problem?

Is there a solution to this other than moving away from Let's Encrypt, which is something I would like to avoid?

As you can see in the screenshots, Chrome in Windows 7 still has the old expired root certificate:

enter image description here

enter image description here

Update:

Through certlm.msc I put into the untrusted ones both "R3" (expired yesterday) and "DST Root CA X3" (expiring today), rebooted the server, but the problem in Chrome on Windows 7 still persists

480
0 + 0
iis
bartonjs avatar
ng flag
bartonjs
Do you have the ISRG Root X1 cert in your trusted root store? If not, I'm guessing that it's mostly that it prefers to build expired chains to trusted roots over time-valid chains to untrusted ones.
0
Reply
gb flag
MirrorMirror
@bartonjs yes ISRG root x1 is in the trusted root store in the IIS server. Again, this happens only for chrome, not for firefox - as a client, and only on windows 7
0
Reply
bartonjs avatar
ng flag
bartonjs
Firefox doesn't use the system certificate store, it carries its own. So it's always unique.
0
Reply
gb flag
MirrorMirror
@bartonjs so what is the solution for web visitors? you can't either contact them (page won't load) and even if you could, you can't expect them to import new root certificates, way too technical. Also why win 10 gets its certificate store updated but win 7 doesn't?
0
Reply
ธงชาติไทย
Elon Musk
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.