Let’s Encrypt’s old root expires on 30 September
When DST Root CA X3 expires, some older devices and software will stop trusting many websites. Test your clients now.
On 30 September the old root certificate that many Let’s Encrypt certificates chain to, DST Root CA X3, expires. Modern browsers and phones already trust Let’s Encrypt’s own root, so most people will notice nothing.
The trouble is with old things:
- Servers and scripts using old OpenSSL 1.0.2 or outdated CA bundles.
- Older macOS, iOS and Windows versions that haven’t updated their root stores.
- Embedded devices, smart TVs and appliances that never get updates.
- API clients built years ago in Java, Python or PHP with their own trust stores.
What to do this week:
- Update CA certificates and OpenSSL on your servers.
- Test your integrations: anything of yours that calls a Let’s Encrypt-secured API, and partners that call you.
- Know who to call if a payment terminal or device stops connecting on 1 October.