Nessus Found Vulnerability: SSL Certificate Cannot Be Trusted

[DaUmega]

Nessus Found Vulnerability: SSL Certificate Cannot Be Trusted

[osirisinferi]

Certbot is an ACME client and is capable of using multiple different ACME servers. Let's Encrypt is the default ACME CA and indeed sends a certificate chain including an intermediate chaining up to an expired root. This is on purpose and you can read more about that at https://letsencrypt.org/2020/12/21/extending-android-compatibility.

This is colloquially called the "long chain". However, the intermediate cross-signed by the DST Root CA X3 root is also expiring on September 30th 2024. Thus Let's Encrypt is transitioning to the regular "short chain". You can read more about this transition at https://letsencrypt.org/2023/07/10/cross-sign-expiration.

Certbot has the --preferred-chain option to be able to select alternative chains if offered by the ACME server. Let's Encrypt currently offers the "short chain" as an alternative chain.

In any case, this is not a bug in Certbot, thus I'm closing this issue 🙂