The expiring Let’s Encrypt DST Root CA X3 can cause problems on old servers:
root@server:/etc# wget https://www.example.com/monitoring --2021-09-30 21:34:39-- https://www.example.com/monitoring Resolving www.example.com (www.example.com)... 126.96.36.199 Connecting to www.example.com (www.example.com)|188.8.131.52|:443... connected. ERROR: The certificate of `www.example.com' is not trusted.
Fortunately there is an easy workaround to ensure the expired chain is not checked.
According to my understanding the issue on some old systems (like Debian wheezy) comes from the old OpenSSL 1.0.1 version which only tries to validate the expired trust chain.
This can be avoided by removing DST Root CA X3 from the systems ca certificates:
/etc/ca-certificates.confand put a bang/exclamation mark (!) before mozilla/DST_Root_CA_X3.crt
Note: This applies to clients that cannot connect to a server using a Let’s Encrypt certificate. It is not a solution for a server using a Let’s Encrypt certificate.
(Based on https://www.agwa.name/blog/post/fixing_the_addtrust_root_expiration)
The expiration is announced here:
There is a help thread with additional informations: