# Old clients: certificate has expired — Let's Encrypt chain uses expired DST Root CA X3 (OpenSSL 1.0.x, Android < 7.1.1)

**Code:** `DST Root CA X3 expired (old clients fail)` · **Category:** SSL / TLS · **Seen on:** SSL, Linux

Older systems fail to validate Let's Encrypt certificates because their trust store lacks ISRG Root X1 and relies on the expired cross-sign.

## Meaning

After 30 Sept 2021 the DST Root CA X3 expired. OpenSSL 1.0.x clients treat the expired cross-signed chain as invalid even when a newer path exists. Fix: update client OS/OpenSSL/CA bundle, or serve a chain without the expired cross-sign (the `--preferred-chain "ISRG Root X1"` option), accepting that very old Android devices fail.

## Common causes

- OpenSSL 1.0.x clients
- Android below 7.1.1
- Old embedded devices lacking ISRG Root X1
- Outdated ca-certificates
- Server serving the cross-signed chain

## Quick fix

1. Update OpenSSL/ca-certificates on the client
2. Use `certbot --preferred-chain "ISRG Root X1"` on the server
3. Remove DST Root CA X3 from the client trust store (`dpkg-reconfigure ca-certificates`)

## Detailed fix by platform

### Linux

1. `sudo update-ca-certificates --fresh` ; check `openssl version`

## How to diagnose

1. **Client** — OpenSSL version/OS?
2. **Chain** — Cross-sign sent?
3. **Trust** — ISRG Root X1 present?

---
Source: [WhatIsMyError](https://whatismyerror.com/errors/ssl/lets-encrypt-root-expired-old-clients)