Can't connect to my server after updating a certificate about grocy-android

[Janovlk]

Hello all,

It's quiet here so I did some research on my own.

The Letsencrypt service now uses ISRG Root X1 as a main certificate. This is not included in certificate store of Android 7 and lower versions. These have the IdenTrust’s DST Root CA X3 certificate to which Letsencrypt issued their intermediate certificates. The DST Root CA X3 expired in 2021. So Letsencrypt provided crossigned certificates to allow older Android devices to connect to Letsencrypt signed services. Unfortunately these will expire on September 30th, 2024.

Since Thursday, Feb 8th, 2024 Letsencrypt stopped to provide the crossigned chain by default.

If someone got his certificate renewed he needs to renew certificate with a new option.
In Linux simply run this command: certbot renew --force-renewal --preferred-chain "DST Root CA X3"
This renews current (pointing to ISRG Root X1) certificate to a new one which is the old crossigned chain way.
You need to change in your Crontab the renewal command too. It should be like this: /usr/bin/certbot renew --preferred-chain "DST Root CA X3"

Now the worst news at the end.
The Letsencrypt will no longer provide any crossigned chain certificates since Thursday, June 6th, 2024. These certificates will expire on Monday, September 30th, 2024.
So older Androids are doomed after that day. The only solution is manually add to Android's certificate store the ISRG Root X1 and ISRG Root X2 certificates. Or maybe try another CA.

I hope it helps.

PP

[patzly]

Sorry we're currently busy with our jobs! Thank you for looking into it yourself! That sounds not that good, I hope the solution you mention works for you. But many certificate deadlines seem to be in 2024...