1

Early this morning, I updated (with win-acme) the web server's (IIS 8.5) SSL certificate due to the known problem of Let's Encrypt with the expiration of the its root certificate (DST Root CA X3). So almost everything is fine and dandy with the new one: Firefox in Win XP 3 SP3, every browser in Windows 10 and Firefox on Windows 7.

However Chrome on Windows 7 shows the old one (DST Root CA X3) instead of the new one. I did clear the SSL state but nothing, still the old expired ones. Chrome is fully updated: Version 94.0.4606.61 (Official Build) (64-bit)

Why is this happening? From reading around, this wasn't supposed to happen with Windows 7, and that the problematic OS would be Win XP less than SP3. Plus, why does Firefox on Windows 7 does not have this problem?

Is there a solution to this other than moving away from Let's Encrypt, which is something I would like to avoid?

As you can see in the screenshots, Chrome in Windows 7 still has the old expired root certificate:

enter image description here

enter image description here

Update:

Through certlm.msc I put into the untrusted ones both "R3" (expired yesterday) and "DST Root CA X3" (expiring today), rebooted the server, but the problem in Chrome on Windows 7 still persists

MirrorMirror
  • 105
  • 2
  • 12
  • Do you have the ISRG Root X1 cert in your trusted root store? If not, I'm guessing that it's mostly that it prefers to build expired chains to trusted roots over time-valid chains to untrusted ones. – bartonjs Sep 30 '21 at 14:12
  • @bartonjs yes ISRG root x1 is in the trusted root store in the IIS server. Again, this happens only for chrome, not for firefox - as a client, and only on windows 7 – MirrorMirror Sep 30 '21 at 14:50
  • Firefox doesn't use the system certificate store, it carries its own. So it's always unique. – bartonjs Sep 30 '21 at 15:25
  • @bartonjs so what is the solution for web visitors? you can't either contact them (page won't load) and even if you could, you can't expect them to import new root certificates, way too technical. Also why win 10 gets its certificate store updated but win 7 doesn't? – MirrorMirror Oct 01 '21 at 12:45

0 Answers0