- Plesk for Linux
- Plesk for Windows
After September 30, 2021, when accessing websites hosted on a Plesk and secured with Let's Encrypt certificates, the error ERR_CERT_AUTHORITY_INVALID is shown.
The certificate DST Root CA X3 is shown in the certificate chain (Padlock icon in address bar > Certificate > Certification Path):Sample screenshots
DST Root CA X3 root certificate expired on September 30, 2021 at 14:01:15 GMT. It affects outdated client operating systems, including the following ones:
- Windows < XP SP3
- Windows 7 (without the specific root certificates update installed).
- macOS < 10.12.1
- iOS < 10
- Android < 7.1.1 (but >= 2.3.6 will work if served ISRG Root X1 cross-sign)
- Ubuntu < 16.04
- Debian < 8
To resolve the issue, install the latest updates for the computer / mobile device (Windows, macOS, Android, iOS, etc.) that is used for accessing websites.
Install the latest OS updates and reboot the server to refresh root certificates cache.
If a Linux server is used and it is up-to-date, no actions are required.
On outdated Linux operating systems, it may be required to apply the steps below:
Connect to the server using SSH.
Open the file
Comment out the line
mozilla/DST_Root_CA_X3.crtby putting the symbol
!to the beginning of the line and save the file.
Execute the below command:
Starting from January 2021, Plesk issues Let's Encrypt certificates using ISRG Root X1.
On Windows, check that Turn off Automatic Root Certificates Update option is disabled in Local Group Policy Editor under Local Computer Policy > Computer Configuration > Administrative Templates > System > Internet Communication > Internet Communication settings. If it is enabled, disable it, install Windows updates and reboot the server.
If an alternative root was enabled in
panel.ini configuration file before:
Connect to the server via SSH/RDP.
Remove the following line from
use-alternate-root = true
Reissue Let's Encrypt certificates for the affected domains.
Please sign in to leave a comment.