DST Root CA X3 expired (old clients fail) SSL / TLS Origin: Network Last updated 4 Nov 2026

Old clients: certificate has expired — Let's Encrypt chain uses expired DST Root CA X3 (OpenSSL 1.0.x, Android < 7.1.1)

Older systems fail to validate Let's Encrypt certificates because their trust store lacks ISRG Root X1 and relies on the expired cross-sign.

Exact message you may see DST Root CA X3 expiredcertificate has expired Let's Encrypt old clientsISRG Root X1 not trustedLet's Encrypt root expiry OpenSSL 1.0.2expired DST Root CA X3 certificate
Explore the map of this error Full error map →
Seen on: SSL Linux

Meaning

After 30 Sept 2021 the DST Root CA X3 expired. OpenSSL 1.0.x clients treat the expired cross-signed chain as invalid even when a newer path exists. Fix: update client OS/OpenSSL/CA bundle, or serve a chain without the expired cross-sign (the --preferred-chain "ISRG Root X1" option), accepting that very old Android devices fail.

Common causes

  • OpenSSL 1.0.x clients
  • Android below 7.1.1
  • Old embedded devices lacking ISRG Root X1
  • Outdated ca-certificates
  • Server serving the cross-signed chain

⚡ Quick fix

  1. Update OpenSSL/ca-certificates on the client
  2. Use certbot --preferred-chain "ISRG Root X1" on the server
  3. Remove DST Root CA X3 from the client trust store (dpkg-reconfigure ca-certificates)

Detailed fix by platform

Linux

  1. sudo update-ca-certificates --fresh ; check openssl version

How to diagnose

  1. Client — OpenSSL version/OS?
  2. Chain — Cross-sign sent?
  3. Trust — ISRG Root X1 present?

🔧 Still not fixed?

Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:

Where this error sits

Origin: Network. Errors that are often confused with or caused by this one (click to open):

DNS problem: NXDOMAIN looking up A — Certbot: Detail: DNS problem: NXDOMAIN looking up A for www.example.com - check that a DNS record exists for this domain (SSL / TLS)DNS problem: NXDOMAIN…ERR_CERT_DATE_INVALID — NET::ERR_CERT_DATE_INVALID (certificate expired) (JavaScript)ERR_CERT_DATE_INVALIDSEC_ERROR_EXPIRED_CERTIFICATE — Firefox: Peer's Certificate has expired. Error code: SEC_ERROR_EXPIRED_CERTIFICATE (SSL / TLS)SEC_ERROR_EXPIRED_CER…The following certs could not be renewed — Certbot: Failed to renew certificate example.com with error — The following certs could not be renewed: /etc/letsencrypt/live/example.com/fullchain.pem (failure) (SSL / TLS)The following certs c…Timeout during connect (likely firewall problem) — Let's Encrypt: Fetching http://example.com/.well-known/acme-challenge/token: Timeout during connect (likely firewall problem) (SSL / TLS)Timeout during connec…too many certificates already issued — Let's Encrypt: urn:ietf:params:acme:error:rateLimited :: too many certificates (5) already issued for this exact set of identifiers in the last 168 hours (SSL / TLS)too many certificates…unable to get local issuer certificate — OpenSSL: error:num=20:unable to get local issuer certificate / SSL: CERTIFICATE_VERIFY_FAILED (SSL / TLS)unable to get local i…DST Root …

Explore the map of this error Full error map →

🧠 Still stuck? Analyze your error

Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.

💬 What worked for others

No tips yet — did something else fix this for you?

Share what worked for you

Tips are checked by an editor before they appear. Links are removed.