Home / server / Questions / 1079505
In Process
manifestor
Asked: 2021-10-05 06:42:35 +0800 CST

Certificate problems since Let's Encrypts CA expired a few days ago

  • 772

I'm running a Debian 10 server and I can't connect to other machines using Let's Enccrypt certificates anymore since LE's CA (DST Root CA X3) expired a few days ago:

root#> curl -I https://example.com                                                                                                                                                                                                                                               
curl: (60) SSL certificate problem: certificate has expired

What I've done so far:

  • I updated the ca-certificates package
  • I installed libgnutls-openssl27 and libgnutls30
  • I ran the update-ca-certificates command.

Still, the server is not able to establish a trusted connection to the target host. The LE certificate on the target host is fine, there are no SSL errors when I trigger curl from any other hosts.

How can I solve this problem and establish a trusted SSL connection? Any help would be highly appreciated, thanks in advance!

debian ssl ssl-certificate openssl lets-encrypt

2 Answers

  1. Disable "DST Root CA X3" the certificate on your server. Run:

    sudo dpkg-reconfigure ca-certificates

    On the first screen that prompts "Trust new certificates from certificate authorities?" choose "yes". On the next screen press the down arrow key on your keyboard until you find mozilla/DST_Root_CA_X3.crt, press the space bar to deselect it (the [*] should turn into [ ]) and press Enter.

    • 2

  2. The symlink CA certificate of the new Let's Encrypt CA was missing in /etc/ssl/certs and it was commented out in /etc/ca-certificates.conf. I created it by running:

    cd /etc/ssl/certs && ln -s /usr/share/ca-certificates/mozilla/ISRG_Root_X1.crt ISRG_Root_X1.pem

    Everything has been working fine since then. You can run dpkg-reconfigure ca-certificates to activate it as well.

    • 0