23

Sometime this morning my browsers started blocking all Stack Exchange sites with the following error:

Your connection is not private

Attackers might be trying to steal your information from workplace.stackexchange.com (for example, passwords, messages, or credit cards).

NET::ERR_CERT_DATE_INVALID

I get this problem in both Chrome (v94.0) and Edge (v94.0), but at least in Edge I can bypass it. This problem is NOT happening on Firefox (92.0). Is anyone else getting this problem? If it's local to me, how should I fix it?

Looking at the Certification Path, the *.stackexchange.com cert is valid, but the certs for DST Root CA X3 and R3 both expired today. Are these something local on my end, or are they on the SE side?

Certification path: DST Root CA X3->R3->*.stackexchange.com

Improve this question
10
  • Maybe try disabling all your scripts/extensions/etc.? It's all working for me, Chrome or not.
    – Ollie
    Commented Sep 30, 2021 at 16:30
  • Not once in seven years on at least twenty site on the N/W. (Chrome 94)
    – W.O.
    Commented Sep 30, 2021 at 16:31
  • 4
    Can you post the certificate details? Odds are something in the middle is injecting a different certificate and this isn't coming from SE.
    – Mad Scientist
    Commented Sep 30, 2021 at 16:36
  • 6
    Someone else reported the same issue - so there's something going on. I've tossed this a status-review since its probably going to need staff to work out what's happening
    – Journeyman Geek Mod
    Commented Sep 30, 2021 at 16:44
  • @Ollie I don't have any extensions, though this is a work-managed computer, so there could be other things going on.
    – David K
    Commented Sep 30, 2021 at 16:50
  • @Mat I added info about the Certification Path, but the SE cert looks okay. Let me know if you still want the actual cert details for any of these three.
    – David K
    Commented Sep 30, 2021 at 16:52
  • @MadScientist see above.
    – David K
    Commented Sep 30, 2021 at 16:52
  • 6
    Their post and forum is here: letsencrypt.org/docs/dst-root-ca-x3-expiration-september-2021 - community.letsencrypt.org/t/…
    – Rob
    Commented Sep 30, 2021 at 18:55
  • I'm experiencing the same issue, but not just with SE sites. Also macworld.com and quora.com, among others. apple.stackexchange.com/questions/428233/…
    – Alex Ixeras
    Commented Oct 1, 2021 at 14:41
  • Here is video reference for reproduction steps to fix the issue with let's encrypt certificates: HOW TO fix Root Certificate Issue on Mac which expired on Sept 30th 2021
    – hexalys
    Commented Jul 13, 2022 at 15:42

2 Answers 2

Reset to default
28

As you noticed, the DST Root CA X3 certificate expired today. In theory, if you're running a current browser (which you are) on a current OS, you should be fine and switch over to the new root certificate (ISRG Root X1). That is what happened on my machine in Chrome v94:

enter image description here

We're double-checking server-side configuration on our end (so far nothing immediately obvious stands out), but in the meantime, can you check the compatibility page and see if your device is supposed to be compatible?

If your OS is on the compatible list to start with, make sure you have all the updates installed as well.

Improve this answer
10
  • OS is definitely on the compatibility list. My machine's updates are managed by my workplace, so I guess I'll just hope it starts working over the next couple days!
    – David K
    Commented Sep 30, 2021 at 18:09
  • 15
    @DavidK This is going to affect a very large number of sites, so your workplace has pretty strong incentives to fix this. This isn't SE-specific, this affects every site that uses Let's Encrypt for certificates.
    – Mad Scientist
    Commented Sep 30, 2021 at 18:34
  • So why does it only affect Chrome and Edge, but not Firefox?
    – Alex Ixeras
    Commented Oct 1, 2021 at 15:07
  • 7
    @AlexIxeras Firefox has its own certificate store while Chrome and Edge rely on the OS.
    – Adam Lear StaffMod
    Commented Oct 1, 2021 at 15:07
  • Since I'm on an older OS (macOS 10.11.6) I believe it doesn't trust ISRG Root X1. I've downloaded the Root CA Certificates (letsencrypt.org/certs/isrgrootx1.pem and letsencrypt.org/certs/isrg-root-x2.pem), plus the Intermediate Certificate (letsencrypt.org/certs/lets-encrypt-r3.pem). I then went to Keychain Access, selected (and unlocked) the 'System' keychain and imported the 3 downloaded PEM file formats. Restarted Chrome (v94), but nothing changed, ie. still can't access SE sites in Chrome. What am I doing wrong?
    – Alex Ixeras
    Commented Oct 2, 2021 at 14:12
  • How do you switch to the new root certificate (ISRG Root X1)? My PC at work has switched to the new certificate and the Stack Exchange sites work as expected. My home PC still has the old certificate and StackExchange sites are being blocked.
    – Rich
    Commented Oct 4, 2021 at 14:19
  • @AlexIxeras Honestly, no idea. Found this, though, that looks like it might help: reddit.com/r/MacOS/comments/pz5dq3/…
    – Adam Lear StaffMod
    Commented Oct 4, 2021 at 15:40
  • 1
    @Rich Are you missing any OS updates? My home and work machines (all Windows) all switched over without issues. Try asking on Super User if you're running into problems.
    – Adam Lear StaffMod
    Commented Oct 4, 2021 at 15:45
  • 1
    I couldn't find any missing OS updates. I installed the new certificate and deleted the old one and now the sites that were being blocked are no longer blocked.
    – Rich
    Commented Oct 4, 2021 at 19:27
  • https://meta.physics.stackexchange.com/ may have a similar problem - "Validity ... Not After ... Wed, 03 Mar 2021 14:00:52 GMT". Other Stack Exchange sites are fine - "Validity ... Not After ... Sat, 06 Aug 2022 13:13:03 GMT"
    – This_is_NOT_a_forum
    Commented Jun 12, 2022 at 10:59
2

Confirmation of the Problem

I'm also getting the problem. I'm in Asia. In order to post here, I actually had to set my system clock back one day to allow my browser (Firefox 48.0.2 on Mac OS X v10.8.3 (Mountain Lion)) to connect here. As soon as the time zone reaches October 1 in other places, I would expect many others will see this problem as well.

Before changing my date, I checked it by proxying my connection through a server in America where it is still September--and the pages loaded perfectly.

The problem is occurring across the board for every single Stack Exchange site, including the chat subdomain shown as an example in the image below.

Enter image description here

This needs attention before it hits more time zones!

The problem occurred with a post-midnight refresh of a page that was already loaded and which looked just fine before the refresh.

rene's comment solved this for me:

Okay, go to Let's Encrypt: https://letsencrypt.org/certificates and download their ISRG Root X1 certificate and add it manually to the Firefox certificate store as Trusted CA. Notice that on the page I linked they also offer test links so you can verify if you installed the certificates correctly. Once it works there, SE sites should work as well.

I hope others can figure this out. If their certificates expire, they won't be seeing this site to learn why.

Improve this answer
10
  • 2
    What browser / OS is this? Include the versions if you can and whether your OS/Browser is managed by an enterprise or by yourself.
    – rene Mod
    Commented Sep 30, 2021 at 18:20
  • 2
    I'm on Mac OSX 10.8.3 and using Firefox 48.0.2. I cannot upgrade Firefox for this OS, so if the SE sites are just throwing users like me under the bus, I won't be back after this. My MacBook is a mid-2013 model and has too much of importance to risk any OS upgrades.
    – Polyhat
    Commented Sep 30, 2021 at 18:24
  • 14
    @Polyhat It's really not our decision to do that, though. Our certificate is valid. We don't control root certificates - those are installed onto your system through standard security updates. Our only solution would be to find a completely different provider to get trust through a different root certificate, which is a bit unreasonable. Refusing to install updates will eventually cause all root certificates on your device to expire over time.
    – animuson StaffMod
    Commented Sep 30, 2021 at 18:27
  • There were no updates to my system between yesterday and today. Nothing changed on my end.
    – Polyhat
    Commented Sep 30, 2021 at 18:29
  • 7
    Okay, go to Let's Encrypt: letsencrypt.org/certificates and download their ISRG Root X1 certificate and add it manually to the Firefox certificate store as Trusted CA. Notice that on the page I linked they also offer test links so you can verify if you installed the certificates correctly. Once it works there, SE sites should work as well.
    – rene Mod
    Commented Sep 30, 2021 at 18:29
  • Firefox tells me the certificate that expired is from the issuer: "SEC_ERROR_EXPIRED_ISSUER_CERTIFICATE". The error does not appear to be related to my end of things at all.
    – Polyhat
    Commented Sep 30, 2021 at 18:32
  • 1
    I suspect Safari on iOS will have a problem with the certificate, since another Let's Encrypt certificate, was also a problem. The problem with the website in question was on an iPhone 13 running iOS 15
    – Ramhound
    Commented Sep 30, 2021 at 18:33
  • 6
    @Polyhat Yes, issuers have root certificates that verify the authenticity of all site certificates, making them trusted, and are usually issued for 10 or 20 years at a time. Root certificates are installed directly onto your system. They are not fetched each time you connect to a site because they are global and not specific to a site. Any site you connected to that uses a Let's Encrypt certificate will stop functioning due to that certificate's expiration if you don't have a new one installed. It's not specific to us in any way.
    – animuson StaffMod
    Commented Sep 30, 2021 at 18:35
  • For reference: superuser.com/a/1054727
    – rene Mod
    Commented Sep 30, 2021 at 18:41
  • 9
    That certificate had a fixed expiry date right when it was issued, so there was no need for there to have been any change on your end for it to become invalid on that date (which was yesterday). It was valid for 21 years, from 2000-2021, the new one is valid till 2035.
    – GoodDeeds
    Commented Oct 1, 2021 at 12:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .