This caused a major problem for me this morning on a Ubuntu 16.04 server. The fix involved removing the DST_Root_CA_X3 certificate from the server and then running "update-ca-certificates".
Let's Encrypt DST Root CA X3 has expired
11–20 of 27 posts
Re: Let's Encrypt DST Root CA X3 has expired
#12Oof, felt this pain. We are having to blacklist the expired SSL cert because our openssl version prefer it over the valid cert. Time to redeploy all things.
Re: Let's Encrypt DST Root CA X3 has expired
#13google cloud monitoring's uptime checks started failing this morning too
https://status.cloud.google.com/ >>>Global: We have identified an issue affecting "Uptime Checks" within Google Cloud Monitoring, impacting customers using "Let's Encrypt" 3rd party certificates.
it generated a scary amount of alerts, almost finished fueling the single-engine before I realized what the problem was.
Re: Let's Encrypt DST Root CA X3 has expired
#14Twitter is abuzz and not in a good way: https://twitter.com/search?q=letsencrypt&src=typed_query&f=l... Slack and Shopify seem to be affected.
Slack had an unrelated DNS issue today
Re: Let's Encrypt DST Root CA X3 has expired
#15Today has been hectic. Anybody have tips on how to resolve the issue for apps on Heroku? I don't have access to remove the DST_Root_CA_X3 cert since my certs are managed by Heroku ACM.
From my understanding, the only way to remedy is to move away from Lets Encrypt...
Re: Let's Encrypt DST Root CA X3 has expired
#16I'm fairly sure this is the issue I see with my TinyTinyRSS instance I'm running via Docker on my Synology (`60 SSL certificate problem: certificate has expired` error on a bunch of feeds using Let's Encrypt certs today). I haven't updated the image in many a moon (since it worked just fine), but now I might have to bite the bullet.
Re: Let's Encrypt DST Root CA X3 has expired
#17Hopefully this will be helpful to some.
The primary problem in most cases is the full chain cert not being updated or used in your configuration.
1. Your Let’s Encrypt script might be outdated and isn’t pulling the down the new chain file. This could be your first problem.
2. Your configuration for Apache or whatever app your using is referencing a chain file that isn’t the current one. This could be your second problem. It’s possible you copied the chain file somewhere a long time ago and have been referencing that one instead of the new one that gets pulled down.
The problem will be confusing because your cert will be current, but it still won’t be trusted.
Something like Dovecot can actually use the full chain cert file as the cert file. This will solve that problem instead of only referencing the .crt file, which won’t help, because it won’t be trusted. The full chain needs to be used.
Re: Let's Encrypt DST Root CA X3 has expired
#18Anybody has an example of website that is running one of the new certificates so we can see if our devices can connect?
There's an official one here: https://valid-isrgrootx1.letsencrypt.org/
Re: Let's Encrypt DST Root CA X3 has expired
#19This was not a fun morning for me. All of my sites which are running on Debian 9 suddenly weren't able to contact our authentication and other internal systems. I had to disable SSL verification until ops can move them to newer servers.
Debian 9 can't be updated to use the new root CA?
Yes, Debian 9 security updates contains the new ca-certificates package.
Re: Let's Encrypt DST Root CA X3 has expired
#20We had hundreds of old lambda functions that have been running for years and so we haven't thought about them for a long time.
Since they were on node v10 they stopped being able to talk to letsencrypt SSL sites today. Since AWS has stopped supporting v10 we couldn't upgrade them to the minor version of v10 that supports the CA