[German]Do you run websites that are signed via Let's Encrypt certificates? Then there could possibly be problems on September 30, 2021. This is because the root certificate used by Let's Encrypt to sign client certificates will lose its validity on this day (expiry of Intermediate R3 on 2021/09/29 at 19:21:40 GMT – the DST Root CA X3 expires on 2021/09/30 14:01:15 GMT). Clients that only know the old root certificates will not be able to verify Let's Encrypt server certificates after that. Addendum: We have seen issues.
Let's Encrypt has published a list of affected products here. Below is an excerpt of the platforms that should still work.
Platforms that trust ISRG Root X1
- Windows >= XP SP3 (assuming Automatic Root Certificate Update isn't manually disabled)
- macOS >= 10.12.1
- iOS >= 10 (iOS 9 does not include it)
- iPhone 5 and above can upgrade to iOS 10 and can thus trust ISRG Root X1
- Android >= 7.1.1 (but Android >= 2.3.6 will work by default due to our special cross-sign)
- Mozilla Firefox >= 50.0
- Ubuntu >= xenial / 16.04 (with updates applied)
- Debian >= jessie / 8 (with updates applied)
- Java 8 >= 8u141
- Java 7 >= 7u151
- NSS >= 3.26
Browsers (Chrome, Safari, Edge, Opera) generally trust the same root certificates as the operating system they are running on. Firefox is the exception: it has its own root store. Soon, new versions of Chrome will also have their own root store.
Platforms that trust DST Root CA X3
- Windows >= XP SP3
- macOS (most versions)
- iOS (most versions)
- Android >= v2.3.6
- Mozilla Firefox >= v2.0
- Ubuntu >= precise / 12.04
- Debian >= squeeze / 6
- Java 8 >= 8u101
- Java 7 >= 7u111
- NSS >= v3.11.9
- Amazon FireOS (Silk Browser)
- Cyanogen > v10
- Jolla Sailfish OS > v18.104.22.168
- Kindle > v3.4.1
- Blackberry >= 10.3.3
- PS4 game console with firmware >= 5.00
You may want to visit this 2015-2017 community forum discussion for more information about compatibility.
- Blackberry < v10.3.3
- Android < v2.3.6
- Nintendo 3DS
- Windows XP prior to SP3
- cannot handle SHA-2 signed certificates
- Java 7 < 7u111
- Java 8 < 8u101
- Windows Live Mail (2012 mail client, not webmail)
- cannot handle certificates without a CRL
- PS3 game console
- PS4 game console with firmware < 5.00
Addendum: We have seen issues
German blog readers has left the feedback, that they run into issues. Sorting it out, there are several pitfalls.
- Some users that has re-newed Let's Encrypt certificates within the last days still got certificates, that has been signed with the now outdates root certificates.
- Some admin reported outdates Let's Encrypt certificates on IIS.
- Some admin reported outdates Let's Encrypt certificates on Exchange.
- And it seems that Sophos UTM is using a Let's Encrypt certificate, that blocks access to mail and web servers.
Some admins was facing the situation, that iOS 14/15 mail clients could not access the mail server. After re-newing the certificates on Exchange and/or Sophos UTM, the issue has been resolved.
Addendum: I've written another blog post about that, see Let's Encrypt certificate trouble with Windows, Sophos UTM, macOS/iOS (2021/09/30).
Cookies helps to fund this blog: Cookie settings