Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Let's Encrypt DST Root CA X3 has expired

twitter.com

Post reply on HN
Print view View original

21–27 of 27 posts

Re: Let's Encrypt DST Root CA X3 has expired

#21

Post by ezekg »

dijit wrote: post #2

This is hurting me pretty bad right now, renewing my LE cert is not fixing it via Terraform.

As far as I understand, renewing with the certbot flag --preferred-chain "ISRG Root X1" [^1] will drop the hack for Android [^1] https://community.letsencrypt.org/t/openssl-client-compatibi...

Re: Let's Encrypt DST Root CA X3 has expired

#23

Post by ezekg »

ezekg wrote: post #15

Today has been hectic. Anybody have tips on how to resolve the issue for apps on Heroku? I don't have access to remove the DST_Root_CA_X3 cert since my certs are managed by Heroku ACM. From my understanding, the only way to remedy is to move away from Lets Encrypt...

I ended up moving away from Lets Encrypt to Comodo. As an API provider, I need to support older OpenSSL versions, and LE and Heroku offer no way for me to do that.

Re: Let's Encrypt DST Root CA X3 has expired

#24

Post by gboudreau »

ezekg wrote: post #15

Today has been hectic. Anybody have tips on how to resolve the issue for apps on Heroku? I don't have access to remove the DST_Root_CA_X3 cert since my certs are managed by Heroku ACM. From my understanding, the only way to remedy is to move away from Lets Encrypt...

You should contact Heroku, to ask them to stop sending that 3rd DST_Root_CA_X3 certificate in the chain. And if you have only a few Heroku apps, you can fix temporarily by obtaining a Let's Encrypt certificate another way, and upload it on Heroku (their web dashboard allows you to do that). I myself changed the DNS entry temporarily, got myself a LE cert on another server, and then changed back the DNS to point to Heroku. I then uploaded me cert chain (two certificates; mine and the R3); and the private key, using the Heroku dashboard. Heroku now has 90 days to fix their side, and then I will be able to switch back to using ACM.

Re: Let's Encrypt DST Root CA X3 has expired

#25

Post by thedanbob »

teddyh wrote: post #19
rudasn wrote: post #7

Earlier quoted context omitted.

Debian 9 can't be updated to use the new root CA?

Yes, Debian 9 security updates contains the new ca-certificates package.

Indeed, unfortunately I already had updated all of my sites before I learned this.

Re: Let's Encrypt DST Root CA X3 has expired

#26

Post by vinhboy »

ezekg wrote: post #15

Today has been hectic. Anybody have tips on how to resolve the issue for apps on Heroku? I don't have access to remove the DST_Root_CA_X3 cert since my certs are managed by Heroku ACM. From my understanding, the only way to remedy is to move away from Lets Encrypt...

I am confused by this conversation you folks are having. My understanding is that Heroku has nothing to do with this. They are correctly using ISRG Root X1 letsencrypt certificates. It is the client's computer that is incorrectly using the old DST Root CA X3 certificate because they have an outdated certificate store.

Please correct me if I am wrong.

Re: Let's Encrypt DST Root CA X3 has expired

#27

Post by pa9am »

mego22 wrote: post #12

Oof, felt this pain. We are having to blacklist the expired SSL cert because our openssl version prefer it over the valid cert. Time to redeploy all things.

This also bit me. I thought I was in the clear not using anything with outdated CA keystores. Turns out that some TLS implementations don't trust the connection if the server provides an expired CA in the certificate chain.

This includes the Nextcloud client for Windows and the DNS over TLS implementation in Android 11.

Adding the argument --preferred-chain "ISRG Root X1" to certbot fixes this by not chaining the expired CA X3...

Post reply on HN