Symptoms
-
After September 30, 2021, when accessing websites hosted on a Plesk and secured with Let's Encrypt certificates, the error ERR_CERT_AUTHORITY_INVALID is shown.
-
The certificate DST Root CA X3 is shown in the certificate chain (Padlock icon in address bar > Certificate > Certification Path):
Sample screenshots
Cause
DST Root CA X3 root certificate expired on September 30, 2021 at 14:01:15 GMT. It affects outdated client operating systems, including the following ones:
- Windows < XP SP3
- Windows 7 (without the specific root certificates update installed).
- macOS < 10.12.1
- iOS < 10
- Android < 7.1.1 (but >= 2.3.6 will work if served ISRG Root X1 cross-sign)
- Ubuntu < 16.04
- Debian < 8
Resolution
To resolve the issue, install the latest updates for the computer / mobile device (Windows, macOS, Android, iOS, etc.) that is used for accessing websites.
For Plesk on Windows Server
Install the latest OS updates and reboot the server to refresh root certificates cache.
Plesk on supported Linux OS
If a Linux server is used and it is up-to-date, no actions are required.
Plesk on outdated (end-of-life) Linux OS
On outdated Linux operating systems, it may be required to apply the steps below:
-
Connect to the server using SSH.
-
Open the file
/etc/ca-certificates.conffor editing. -
Comment out the line
mozilla/DST_Root_CA_X3.crtby putting the symbol!to the beginning of the line and save the file. -
Execute the below command:
# update-ca-certificates