Let's Encrypt change on September 30 (DST Root CA X3)

[markusfi]

Hi everyone,

as you probably know the Let´s Encrypt DST Root CA X3 will expire on September 30.
https://letsencrypt.org/docs/dst-root-ca-x3-expiration-september-2021/

I renewed my certificate today using Azure Let's Encrypt and it will expire October 17.
But the root will expire before that, and the intermediate R3 even before on September 29.

I read that I should not worry, and there are multiple chains, one chain to the expiring DST Root CA X3 and another Chain to ISRG Root X1.

If this is true, then my browser should still trust the connection on October 16, right?

So first I changed the current date of my browser to September 28.
Everything is fine on September 28.

So then I changed the current date of my browser to October 16.
That´s is fine for my certificate, but not for the root any more.

And so Chrome and Edge both are telling me the connection is not trused.
So it seems to me that I am getting into a lot of trouble and so is everyone else?

Do you know if this Let's Encrypt change is a problem in Azure Let's Encrypt?

Thanks for advance.

[sjkp]

Hi Markus I probably have to make some updates to the extension. I will have a look next week when I'm back from vacation. /Simon

…

On 2021-07-19 21:06, Markus Fischer wrote: Hi everyone, as you probably know the Let´s Encrypt DST Root CA X3 will expire on September 30. https://letsencrypt.org/docs/dst-root-ca-x3-expiration-september-2021/ I renewed my certificate today using Azure Let's Encrypt and it will expire October 17. But the root will expire before that, and the intermediate R3 even before on September 29. I read that I should not worry, and there are multiple chains, one chain to the expiring DST Root CA X3 and another Chain to ISRG Root X1. If this is true, then my browser should still trust the connection on October 16, right? So first I changed the current date of my browser to September 28. Everything is fine on September 28. So then I changed the current date of my browser to October 16. That´s is fine for my certificate, but not for the root any more. And so Chrome and Edge both are telling me the connection is not trused. So it seems to me that I am getting into a lot of trouble and so is everyone else? Do you know if this Let's Encrypt change is a problem in Azure Let's Encrypt? Thanks for advance. -- You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub [1], or unsubscribe [2]. Links: ------ [1] #393 [2] https://github.com/notifications/unsubscribe-auth/AAZ5Q4FFCEFRMRV5SEFBZDTTYRZSXANCNFSM5AUJJEVA

[nemesmia-gm]

Any news on this?

It might be related to the previous Issue "Server Error in '/letsencrypt' Application.
Can not find issuer 'C=US,O=(STAGING) Internet Security Research Group,CN=(STAGING) Doctored Durian Root CA X3' for certificate 'C=US,O=(STAGING) Internet Security Research Group,CN=(STAGING) Pretend Pear X1'. "

[dombarnes]

I’ve actually hit issues now with android 7.1.- and lower devices now not trusting my certificates. Not yet sure why it’s happened ahead of September.

[nemesmia-gm]

I cannot use staging at all now. When trying to install the certificate from kudu I get this error: AcmeException: Can not find issuer 'C=US,O=(STAGING) Internet Security Research Group,CN=(STAGING) Doctored Durian Root CA X3' for certificate 'C=US,O=(STAGING) Internet Security Research Group,CN=(STAGING) Pretend Pear X1'.]
Certes.Pkcs.CertificateStore.GetIssuers(Byte[] der) +429
Certes.CertificateChainExtensions.ToPem(CertificateChain certificateChain, IKey certKey) +185
LetsEncrypt.Azure.Core.Services.d__5.MoveNext() in D:\a\1\s\LetsEncrypt.SiteExtension.Core\Services\AcmeService.cs:61
.......

[henkkelder]

I also have problems with android devices. The ISRG Root X1 Certificate is missing from the chain.

[henkkelder]

I have replaced the Let's Encrypt certificate with the free app service managed certificate. Now old Android devices are working again.

I think the problem is that the ISRG Root X1 Certificate is not in the supplied certificate used in the SSL. On newer devices the missing certificate can be found in the device local certificate stores, but older Android devices do not have that cert.

[kfrancis]

Same issue here.