Skip to content

Conversation

@akshay201
Copy link

remove certs which are not needed to avoid certificates conflict with the existing default certs.

@kingsly
Copy link

kingsly commented Mar 23, 2022

Doesn't look right to me. Some of those certificates are required.

Eg. isrgrootx1.pem is the actual Let's Encrypt Root and is needed.

The only certificate you have left is an intermediate cert, so the server will not be able to send out a full chain and this will break things.

Please go through https://letsencrypt.org/certificates/ to understand how the Let's Encrypt certificate chain works instead of adding/removing certificates by trial and error.

@akshay201
Copy link
Author

Have added the following certs back

lets-encrypt-e1.pem
isrgrootx1.pem
isrg-root-x2.pem
isrg-root-x2-cross-signed.pem

Removing below certs

lets-encrypt-r3-cross-signed.pem
isrg-root-x1-cross-signed.pem

as the issuer for this certificates is O=Digital Signature Trust Co., CN=DST Root CA X3, whose certificate has been expired as per below and using same fails to startup the VPN with the error "Issuer certificate is invalid"

        Validity
            Not Before: Sep 30 21:12:19 2000 GMT
            Not After : Sep 30 14:01:15 2021 GMT
        Subject: O = Digital Signature Trust Co., CN = DST Root CA X3

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants