3 ms·
Today has been hectic. Anybody have tips on how to resolve the issue for apps on Heroku? I don't have access to remove the DST_Root_CA_X3 cert since my certs ar
by ezekg 5y ago
Today has been hectic. Anybody have tips on how to resolve the issue for apps on Heroku? I don't have access to remove the DST_Root_CA_X3 cert since my certs are managed by Heroku ACM.
From my understanding, the only way to remedy is to move away from Lets Encrypt...
- ezekg 5y agoI ended up moving away from Lets Encrypt to Comodo. As an API provider, I need to support older OpenSSL versions, and LE and Heroku offer no way for me to do that.
- gboudreau 5y agoYou should contact Heroku, to ask them to stop sending that 3rd DST_Root_CA_X3 certificate in the chain. And if you have only a few Heroku apps, you can fix temporarily by obtaining a Let's Encrypt certificate another way, and upload it on Heroku (their web dashboard allows you to do that). I myself changed the DNS entry temporarily, got myself a LE cert on another server, and then changed back the DNS to point to Heroku. I then uploaded me cert chain (two certificates; mine and the R3); and the private key, using the Heroku dashboard. Heroku now has 90 days to fix their side, and then I will be able to switch back to using ACM.
- vinhboy 5y agoI am confused by this conversation you folks are having. My understanding is that Heroku has nothing to do with this. They are correctly using ISRG Root X1 letsencrypt certificates. It is the client's computer that is incorrectly using the old DST Root CA X3 certificate because they have an outdated certificate store. Please correct me if I am wrong.