Home / server / Questions / 1079261
In Process
miguelmorin
Asked: 2021-10-02 00:12:09 +0800 CST

User agents not trusting web server due to Let's Encrypt DST Root CA X3 root certificate expiration

  • 772

I handle a NodeJS server with an SSL certificate issued by Let's Encrypt. It works on some clients (Safari and Firefox on my macOS) and not others (curl on my macOS, Safari on iOS). The notice on iOS is:

Not trusted

Expired 30/09/21 07:01:15

The notice on curl is:

curl: (60) SSL certificate problem: certificate has expired
More details here: https://curl.haxx.se/docs/sslcerts.html

curl performs SSL certificate verification by default, using a "bundle" of Certificate Authority (CA) public keys (CA certs). If the default bundle file isn't adequate, you can specify an alternate file using the --cacert option.

Inspecting the certificate shows that dates are valid. I found this warning from Let's Encrypt:

The DST Root CA X3 root certificate expired September 30 14:01:15 2021 GMT.

...

If your site is working for most devices but not for some, the problem is with their trust store (their list of trusted root certificate).

...

macOS, iOS etc

Some operating systems hold onto the expired R3 > DST Root CA X3 chain even if your server is no longer using it. Try a restart of the affected client device.

I forced a renewal of the certificate, copied the private key and the full chain to the NodeJS location, and restarted the server. I restarted the iOS device. The new date shows on my browsers and on the iOS device. But the iOS device still does not trust the website.

The website is www.emotionathletes.og .

How can I ensure that all clients get the right certificate chain and can visit the website?

certificate-authority ssl-certificate node.js lets-encrypt

1 Answers

  1. Since you can't control your clients then the safest way would be to start using some other CA issued certificates.

    One possible CA would be ZeroSSL (https://zerossl.com). They offer also certificates via ACME protocol without any fee like Let's Encrypt (https://zerossl.com/letsencrypt-alternative/) and have a pretty good compatibility with older devices (https://help.zerossl.com/hc/en-us/articles/360058294074-ZeroSSL-Compatibility-List).

    If you're already using certbot command line tool to manage your Let's Encrypt certificates then you can add few additional switches to it to start issuing ZeroSSL certificates instead:

    $ certbot ... --server https://acme.zerossl.com/v2/DV90 --eab-kid XXX --eab-hmac-key YYY

    You can get the --eab-kid and --eab-hmac-key values from ZeroSSL website after you've registered an account for yourself.

    • 2