I am very curious about what the community thinks. After Sept 2021, they will no longer be co-signed by DST Root CA X3, and basically any platform from 2016 or older will not validate their certificates.

This is really frustrating for me-- I have lots of sites I switched to Let's Encrypt for the simplicity of it's auto-renew via certbot, as well as it being free of course.

But coming up in just a few months, MacOS 10.12 and below will reject my sites, not to mention a bunch more situations on this list: https://letsencrypt.org/docs/certificate-compatibility/. According to my stats, I still have visitors (not many, but still) coming in from some of these platforms.

I really wish they would just continue to be cross-signed by DST Root CA X3 (EDIT: or some other valid CA) for another 5 years :/

What is everyone else doing about this problem?

  • How would the continued cross-signing actually work, given that "DST Root CA X3" itself expires on Sep 2021?
    – user1686
    Apr 21, 2021 at 1:16
  • I guess what I mean is, I wish they'd figure out another way to (with a different CA) to maintain good compatibility for another 5 years, before trying to just rely exclusively on their own CA which was only just created in 2016.
    – Richard
    Apr 21, 2021 at 1:18
  • @Richard I'm just riding the wave myself and gonna see what happens since you asked what others are doing. I'm just going with the flow and will see who screams. If the business side people demand a solution and hear from enough people with troubles, then there will be some companies that will have a decision to make about using another SSL certificate provider perhaps. You wanted free SSL so this is what you get with that. If you need another 5 years, then there are other SSL options that's not Let's Encrypt. Seems like an easy problem too resolve and especially if you automate things. Apr 21, 2021 at 1:30
  • This isn't a question appropriate to a Question and Answer site. You are asking opinions, conversation, which is good to do, especially on a subject like this. This question should be asked on a forum where discussion and conversation is the goal. SU is not a forum, and is about questions that can have a single specific, correct, answer. Apr 21, 2021 at 1:53


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.