DST Root CA X3 expired Sept 30th 2021

NoN · 30 Sep 2021

Hi there, been a while and still using my Windows 7 Sp1 everyday...
Posting this here:

Source (Scott Helme)

Let's Encrypt (chain of trust)

I got some troubleshots on some sites but nothing really serious at the moment. I tried to follow their advices by installing the new self-signed ISRG Root X1 certificat (but not so new 2015) and deleting the expired one, but upon reboot the DST Root CA X3 reappeared in the OS cert store. Therefore i got the two certificates installed now side by side and seems go along together as the OS might point to the old expired one. I've reset the hosts file too, but no change on some sites connectivity.

more infos (certify the web)

Alejandro85 · 01 Oct 2021

Yesterday got hit by the same and solved by downloading the new certificate from here:
ISRG Root X1 . SSL-Tools

Get the .pem version, rename to .crt upon download, double click and import into the "trusted root entity certificates" store. I've also had to restart the browser in order for it to catch the change. Everything else just work from that point on.

Deleting the old certificate is not necesary, nor the hosts file has any relevance in this problem.

NoN · 01 Oct 2021

Alejandro85 said:

Yesterday got hit by the same and solved by downloading the new certificate from here:
ISRG Root X1 . SSL-Tools

Get the .pem version, rename to .crt upon download, double click and import into the "trusted root entity certificates" store. I've also had to restart the browser in order for it to catch the change. Everything else just work from that point on.

Deleting the old certificate is not necesary, nor the hosts file has any relevance in this problem.

Thanks for your input.
I heard and see they provide up there the DST Root CA X3 valid until 2024 too.

Alejandro85 · 01 Oct 2021

NoN said:

I heard and see they provide up there the DST Root CA X3 valid until 2024 too.

No, the download you see there is a ISRG Root X1 which is signed by DST Root CA X3, not a self signed one which is what you expect for a root CA certificate, so it'll fail in the very same way as you're still using the expired certificate as part of the chain.

For all practical purposes DST Root CA X3 is dead. Just install the new one (valid until 2035) and move on.

NoN · 01 Oct 2021

Which I did yesterday with the ISRG Root X1..Thx for having clearing it up.

Megahertz07 · 01 Oct 2021

Alejandro85 said:

No, the download you see there is a ISRG Root X1 which is signed by DST Root CA X3, not a self signed one which is what you expect for a root CA certificate, so it'll fail in the very same way as you're still using the expired certificate as part of the chain.

For all practical purposes DST Root CA X3 is dead. Just install the new one (valid until 2035) and move on.

@Alejandro85, can you explain what are those for?
I use Firefox or Edge. Do need those?

NoN · 03 Oct 2021

I forgot to mention that I either put two of the certificates DST Root CA X3 in the Non-Authorized certificates store by drag and drop them there, after unactivated them in their properties. They haven't recreated themselves in their original place (Third-Party store), ISRG Root X1 replace them there. Both are from Let's Encrypt and both tagged "revoked".