News for hackers. Stuff that matters.

A comment on Let's Encrypt DST Root CA X3 has expired.

Re:Let's Encrypt DST Root CA X3 has expired by mego22 on Thursday September 30, 2021 @03:18PM (#28710169)
Oof, felt this pain. We are having to blacklist the expired SSL cert because our openssl version prefer it over the valid cert. Time to redeploy all things.
[ Parent | on HN ]
Re:Let's Encrypt DST Root CA X3 has expired by pa9am on Friday October 01, 2021 @08:56PM (#28725025)
This also bit me. I thought I was in the clear not using anything with outdated CA keystores. Turns out that some TLS implementations don't trust the connection if the server provides an expired CA in the certificate chain.

This includes the Nextcloud client for Windows and the DNS over TLS implementation in Android 11.

Adding the argument --preferred-chain "ISRG Root X1" to certbot fixes this by not chaining the expired CA X3...

[ Parent | on HN ]