Knowledge Base

Plesk websites secured by Let’s Encrypt certificates show ERR_CERT_AUTHORITY_INVALID warning after September 30, 2021

Symptoms

After September 30, 2021, when accessing websites hosted on a Plesk and secured with Let's Encrypt certificates, the error ERR_CERT_AUTHORITY_INVALID is shown.
The certificate DST Root CA X3 is shown in the certificate chain (Padlock icon in address bar > Certificate > Certification Path):

Sample screenshots

Cause

DST Root CA X3 root certificate expired on September 30, 2021 at 14:01:15 GMT. It affects outdated client operating systems, including the following ones:

Windows < XP SP3
Windows 7 (without the specific root certificates update installed).
macOS < 10.12.1
iOS < 10
Android < 7.1.1 (but >= 2.3.6 will work if served ISRG Root X1 cross-sign)
Ubuntu < 16.04
Debian < 8

Resolution

To resolve the issue, install the latest updates for the computer / mobile device (Windows, macOS, Android, iOS, etc.) that is used for accessing websites.

For Plesk on Windows Server

Install the latest OS updates and reboot the server to refresh root certificates cache.

Plesk on supported Linux OS

If a Linux server is used and it is up-to-date, no actions are required.

Plesk on outdated (end-of-life) Linux OS

On outdated Linux operating systems, it may be required to apply the steps below:

Connect to the server using SSH.
Open the file /etc/ca-certificates.conf for editing.
Comment out the line mozilla/DST_Root_CA_X3.crt by putting the symbol ! to the beginning of the line and save the file.
Execute the below command:

# update-ca-certificates