Join Log in
Score:1
miguelmorin avatar Server

User agents not trusting web server due to Let's Encrypt DST Root CA X3 root certificate expiration

jp flag
miguelmorin

I handle a NodeJS server with an SSL certificate issued by Let's Encrypt. It works on some clients (Safari and Firefox on my macOS) and not others (curl on my macOS, Safari on iOS). The notice on iOS is:

Not trusted

Expired 30/09/21 07:01:15

The notice on curl is:

curl: (60) SSL certificate problem: certificate has expired
More details here: https://curl.haxx.se/docs/sslcerts.html

curl performs SSL certificate verification by default, using a "bundle" of Certificate Authority (CA) public keys (CA certs). If the default bundle file isn't adequate, you can specify an alternate file using the --cacert option.

Inspecting the certificate shows that dates are valid. I found this warning from Let's Encrypt:

The DST Root CA X3 root certificate expired September 30 14:01:15 2021 GMT.

...

If your site is working for most devices but not for some, the problem is with their trust store (their list of trusted root certificate).

...

macOS, iOS etc

Some operating systems hold onto the expired R3 > DST Root CA X3 chain even if your server is no longer using it. Try a restart of the affected client device.

I forced a renewal of the certificate, copied the private key and the full chain to the NodeJS location, and restarted the server. I restarted the iOS device. The new date shows on my browsers and on the iOS device. But the iOS device still does not trust the website.

The website is www.emotionathletes.og .

How can I ensure that all clients get the right certificate chain and can visit the website?

2391
0 + 0
anx avatar
fr flag
anx
see also: https://serverfault.com/questions/1079199/client-on-debian-9-erroneously-reports-expired-certificate-for-letsencrypt-issue https://serverfault.com/questions/1079234/since-sep-30-140115-2021-gmt-any-software-using-openssl-1-0-like-curl-php
1
Reply
cn flag
Quinn Comendant
Your website https://emotionathletes.org/ is working in newest versions of Chrome, Safari, and Firefox on macOS and Safari on iOS. Are you having trouble with very old devices? As for `curl`, you may need to update the certificates it uses to verify TLS connections, see instructions here: https://stackoverflow.com/a/69413675/277303
0
Reply
Score:2
avatar Server
us flag
Jarmo Pertman

Since you can't control your clients then the safest way would be to start using some other CA issued certificates.

One possible CA would be ZeroSSL (https://zerossl.com). They offer also certificates via ACME protocol without any fee like Let's Encrypt (https://zerossl.com/letsencrypt-alternative/) and have a pretty good compatibility with older devices (https://help.zerossl.com/hc/en-us/articles/360058294074-ZeroSSL-Compatibility-List).

If you're already using certbot command line tool to manage your Let's Encrypt certificates then you can add few additional switches to it to start issuing ZeroSSL certificates instead:

$ certbot ... --server https://acme.zerossl.com/v2/DV90 --eab-kid XXX --eab-hmac-key YYY

You can get the --eab-kid and --eab-hmac-key values from ZeroSSL website after you've registered an account for yourself.

0 + 0
ธงชาติไทย
Elon Musk
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.