DST Root CA X3 根证书 9 月份失效了，为什么 let encrption 还下发老的 ISRG Root X1?

V2EX = way to explore

V2EX 是一个关于分享和探索的地方

For Existing Member Sign In

This topic created in 1609 days ago, the information mentioned may be changed or developed.

acme.sh 签发的 ssl 。

因为这个问题，老是提示

1]: Peer certificate not required
2021.12.06 14:15:42 LOG6[0]: Client CA: C=US, O=Let's Encrypt, CN=R3
2021.12.06 14:15:42 LOG6[0]: Client CA: C=US, O=Internet Security Research Group, CN=ISRG Root X1
2021.12.06 14:15:42 LOG4[0]: CERT: Pre-verification error: unable to get issuer certificate
2021.12.06 14:15:42 LOG4[0]: Rejected by CERT at depth=2: C=US, O=Internet Security Research Group, CN=ISRG Root X1

真是坑啊，耗费了 3 个小时。

2 replies • 2021-12-07 02:28:55 +08:00

ysc3839

Dec 6, 2021 via Android

好像是因为 Android 系统不会检查根证书是否过期，这么做可以兼容大量老设备。

phy25

Dec 7, 2021 via Android

/t/798975