Expired SSL certificate errors - Object Storage

If you’ve been seeing these errors as of September 30, 2021 it’s likely a result of the recent expiration of IdenTrust's root certificate, DST Root CA X3.

Tl;dr - It can take a while (years) for a Certificate Authority (CA) to have their application for their own root certificate approved. Once it is approved they face the uphill battle of getting that certificate propagated across global devices which will happen through device and software updates. In the meantime they can use cross-signing to serve secured content through another CA's root certificate.

Since Let’s Encrypt began, they’ve been using a cross-signed root certificate (DST Root CA X3) through IdenTrust - a long-time CA who’s certificates have been around for a while and therefore provide backwards-compatibility for older browsers and devices that haven’t been updated to include newer root certificates. A more detailed backstory can be had here:

• https://letsencrypt.org/2020/11/06/own-two-feet.html


As mentioned above, DST Root CA X3 expired on September 30, so Let’s Encrypt is solely reliant on their own root certificate, ISRG Root X1. If users are working with older devices, browsers, or OpenSSL versions that don’t include this trusted root certificate, users will experience error messages stating their SSL cert has expired.

A full list for ISRG Root X1 compatibility can be found here:

• https://letsencrypt.org/docs/certificate-compatibility/
• https://community.letsencrypt.org/t/openssl-client-compatibility-changes-for-let-s-encrypt-certificates/143816

And a more detailed explanation of these changes - what they mean and how they work - can be found in these detailed blog posts:

• https://letsencrypt.org/2020/11/06/own-two-feet.html
• https://scotthelme.co.uk/lets-encrypt-old-root-expiration/
• https://scotthelme.co.uk/lets-encrypt-to-transition-to-isrg-root/

Essentially users will need to ensure they’re working with updated devices and software in order to get their devices to trust these newer root certificates.

For those using an older version of OpenSSL (<= 1.0.2), instructions on how to build workarounds are detailed in the below OpenSSL blog post:

• https://www.openssl.org/blog/blog/2021/09/13/LetsEncryptRootCertExpire/