LetsEncrypt - SSL certificate is not valid

Quote from Nuxwin

Good morning

So many solutions here

The problem is not about certbot, nor about i-MSCP or its LetsEncrypt plugin but about openSSL v1.0.x which cannot validate the SSL certificates.

To solve the problem, you need in order:

1. Make sure that the CA ISRG Root X1 is installed on your system (in /etc/ssl/certs) : PEM AVAILABLE HERE
2. Remove the old X3 (mozilla) CA which has expired

kess Good job. I don't think that all steps are required. You don't need to import the full CA. Regarding certbot, I'll update it.

kivamp You're totally right. To solve the problem, install the ISRG root X1 and remove the expired one manually from /etc/ssl/certs

Display More

Worked for nearly anything except SMTP, Mail Clients who try to send mails via SSL got Error "Encryptionmethod not supported".

hello

i don't understand

what is the solution, do you have a tuto

thanks

stephan

Hi guys,

So many comments and possible solutions to this. Whats the final solution?

Many thanks,

Hello ! I am still on Ubuntu 16.04 (yes. Please grill me )

I tried all the offered solutions but I still get the error in Domain overview that the cert is invalid.

I updated the CA-Certs and replaced the IRG1

SSL certificate is not valid: CN = osteria-caruso.de error 20 at 0 depth lookup: unable to get local issuer certificate

Any help is appreciated.

Best wishes

Niels

there is no final solution yet.

some customer php-scripts also make use of "openssl verify". they're also fail.

and its not the openssl version. openssl3.0 says also

The problem is that the certbot used by the plugin still generates a chain with old X3 in it. Got no idea how to get rid of it, yet

Update your certbot and enforce the use of ISRG1, or use the solution provided by kess (which seems to work)

Hi,

Sorry for lame questions flame me later.

To clarify is this the solution?

1. Download the CA ISRG Root X1.pem file from the link in the thread

2. Copy it to /etc/ssl/certs/ISRG_Root_X1.pem

3. Run update-ca-certificates -f

4. Delete old cert in /etc/ssl/certs?

Whats the name of the cert that needs deleting? Do you need to restart any services after?

Thanks,

robbo007

Best solution for now (by vege.net but rewrited a bit by me):

1. cd /usr/share/ca-certificates/mozilla/

2. wget https://letsencrypt.org/certs/lets-encrypt-r3.pem

3. mv lets-encrypt-r3.pem lets-encrypt-r3.crt

4. dpkg-reconfigure ca-certificates
In this step check new letsencrypt Cert (lets-encrypt-r3.crt)

5. Edit file: /var/www/imscp/engine/PerlLib/iMSCP/OpenSSL.pm and comment line 134 with # to look like that:

6. Go to Let's Encrypt tab on your domains and press button to renew certificate.

Not working since 06.06.2024.

Quote from theqkash

robbo007

Best solution for now (by vege.net but rewrited a bit by me):

1. cd /usr/share/ca-certificates/mozilla/

2. wget https://letsencrypt.org/certs/lets-encrypt-r3.pem

3. mv lets-encrypt-r3.pem lets-encrypt-r3.crt

4. dpkg-reconfigure ca-certificates
In this step check new letsencrypt Cert (lets-encrypt-r3.crt)

5. Edit file: /var/www/imscp/engine/PerlLib/iMSCP/OpenSSL.pm and comment line 134 with # to look like that:

Code

1. my $cmd = [
2. 'openssl', 'verify',
3. # ( ( $self->{'ca_bundle_container_path'} ne '' ) ? ( '-CAfile', $self->{'ca_bundle_container_path'} ) : () ),
4. '-purpose', 'sslserver', $self->{'certificate_container_path'}
5. ];

6. Go to Let's Encrypt tab on your domains and press button to renew certificate.

Display More

Thanks so much for clarifying this. Worked perfectly.