I handle a NodeJS server with an SSL certificate issued by Let's Encrypt. It works on some clients (Safari and Firefox on my macOS) and not others (curl on my macOS, Safari on iOS). The notice on iOS is:
Not trustedExpired 30/09/21 07:01:15The notice on curl is:
curl: (60) SSL certificate problem: certificate has expiredMore details here: https://curl.haxx.se/docs/sslcerts.htmlcurl performs SSL certificate verification by default, using a "bundle" of Certificate Authority (CA) public keys (CA certs). If the default bundle file isn't adequate, you can specify an alternate file using the --cacert option.Inspecting the certificate shows that dates are valid. I found this warning from Let's Encrypt:
The DST Root CA X3 root certificate expired September 30 14:01:15 2021 GMT.
...
If your site is working for most devices but not for some, the problem is with their trust store (their list of trusted root certificate).
...
macOS, iOS etc
Some operating systems hold onto the expired R3 > DST Root CA X3 chain even if your server is no longer using it. Try a restart of the affected client device.
I forced a renewal of the certificate, copied the private key and the full chain to the NodeJS location, and restarted the server. I restarted the iOS device. The new date shows on my browsers and on the iOS device. But the iOS device still does not trust the website.
The website is www.emotionathletes.og .
How can I ensure that all clients get the right certificate chain and can visit the website?