Trouble with Let's Encrypt cross-signed certificate?

oriane · October 7, 2021, 4:23pm

Hi,

I’ve been using a third-party library (pyTwitchAPI) for subscribing to stream.online events for a few months. But last week my app stopped working out of the blue, with no code change on my part.

I checked with several library users but everything is fine with them. I’ve yet to do more thorough debugging but I strongly suspect this has something to do with my X.509 certificate, which is issued by Let’s Encrypt.

More precisely my cert is issued by ‘Let’s Encrypt R3’, which was cross-signed by both a valid root (ISRG Root X1) and another root (IdenTrust) which expired on September 30th. Which is exactly the day my app stopped working.

It’s related to some issues e.g. a plain wget on my server from my Debian 10 fails with a ‘certificate has expired’ error, even though I’m actually presenting the new, valid root.

Could it be that Twitch stopped trusting the R3 certificate altogether because of the cross-signature?

BarryCarlyon · October 7, 2021, 7:34pm

See this post

github.com/electron/electron

[Bug]: Let's Encrypt root CA isn't working properly

opened 02:56PM - 30 Sep 21 UTC

closed 08:22PM - 30 Sep 21 UTC

leonekmi

bug

### Preflight Checklist - [X] I have read the [Contributing Guidelines](https…://github.com/electron/electron/blob/main/CONTRIBUTING.md) for this project. - [X] I agree to follow the [Code of Conduct](https://github.com/electron/electron/blob/main/CODE_OF_CONDUCT.md) that this project adheres to. - [X] I have searched the [issue tracker](https://www.github.com/electron/electron/issues) for a feature request that matches the one I want to file, without success. ### Electron Version 15.0.0 Reproduced on Electron 12, 13, 14 ### What operating system are you using? Other Linux ### Operating System Version Arch Linux rolling ### What arch are you using? x64 ### Last Known Working Electron version _No response_ ### Expected Behavior The request to `https://letsencrypt.org` (or any Let's Encrypt secured website) should work in the main process as the certificate chain seems valid. ### Actual Behavior It doesn't work in the main process. However, it works in the renderer (with standard Fetch API) or in Node 16.5 REPL (also with Axios). ### Testcase Gist URL https://gist.github.com/fc9cc8d91df7d02f211698f9aceb0087 ### Additional Information I think it's probably related to the recent expiry of DST Root CA X3 but strangely enough, it's working properly on the renderer and in a single Node app? My understanding is that by default, Node.js uses a capture of the Mozilla trust CA, could it be that the Electron one is unsynced?

Which describes a solution

oriane · October 8, 2021, 10:53pm

Thanks for the quick reply, I’ll validate the answer once I’ll get to check.

system · November 7, 2021, 10:53pm

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.