Solved Certificate error on websites with "Lets Encrypt" certificate

[andy295]

Certificate error on websites with "Lets Encrypt" certificate

I get a certificate error on every site that has a Let's Encrypt certificate. It happens in IE11, Chrome and Safari, so I'm assuming it's a Windows issue.

I can still ignore the warning and proceed to the site, but it's very annoying as loads of sites use Let's Encrypt.


Thanks for any suggestions.

(I'm using Windows 7 Pro 64-bit, SP1)

 

[Alejandro85]

What is the error exactly? Why the browsers complain? It could be a problem in your computer or a legitimate problem with the affected websites.

As with every certificate error, ignoring the error without understanding its nature is not only annoying, but a security risk as the browsers say.

 

[andy295]

Thanks. I don't see how it can be a problem with the websites themselves as there are no errors for the same sites on various other computers I've tried. Even Lets Encrypt's own website throws an error on mine.

Here's an example of the error in Chrome. I've used Let's Encrypt's website as an example:

Your connection is not private

Attackers might be trying to steal your information from letsencrypt.org (for example, passwords, messages or credit cards). Learn more
NET::ERR_CERT_AUTHORITY_INVALID
Subject: letsencrypt.org
Issuer: TrustID Server CA A52
Expires on: 2 Feb 2018
Current date: 29 Aug 2017

In IE, the error is:

There is a problem with this website’s security certificate.

The security certificate presented by this website was not issued by a trusted certificate authority.

Security certificate problems may indicate an attempt to fool you or intercept any data you send to the server.

We recommend that you close this webpage and do not continue to this website.

 

[andy295]

bump...

 

[keithcun]

i have had exactly the same problem and found that DST Root CAX3 is missing from the Trusted Root Certification Authorities - this can be accessed by typing - certmgr.msc into your "search programs and files " box at bottom of box when you left click the windows globe. This accesses certificate - current users -
click - Trusted Root Certification Authotities - Then in Object Type window double click - certificates- check if DST Root CA X2 is listed. If not this is your problem.

You will have to import this file from another computer or I can send it to you if you would like to pm me.

To check if this is indeed the problem. whenever you log into a site which throws up the problem ie letsencrypt - click ignore the warning sign as you have been doing - click the red box at the top of the screen - certificate error. This should open certificate box - click Certificate Path which gives info on where the certificate file should be held, and finally click view certificate which will tell you it is missing from the trusted store.

This fixed it for me and if you have any problems either with my explanation or require the DST file please get in touch

 

[andy295]

Thanks, keithcun, that's fixed it!

It was actually DST Root CA X3. Once I knew what it was, I was able to export the certificate from another PC using certmgr and import it into mine using MMC.

I was beginning to lose hope two months after posting so thanks for replying. You're a star!

 

[keithcun]

Andy

Glad this solved the problem

After fixing this problem I found another web site which gave the same problem.(Mapguest)

This time it was another missing certificate which again I was able to fix by the same method.

I was thinking that maybe a Windows update or in my case an Avast update could have deleted these certificates.

Lets hope there are no more problems