I have an Ubuntu 14.04.5 LTS installation. It just recently became unable to verify modern Let's Encrypt certificates. The current version of ca-certificates is 20160104ubuntu0.14.04.1. apt search ca-certificates tells me that the package is upgradeable to 20170717~14.04.2 from trusty-updates, but I think that's probably not modern enough.

I see ca-certificates version 20210119~18.04.2 in bionic-updates. Is it possible to install this without disrupting the system? Is there a better way? Thanks.


You can install the latest stable certs from source (you'll need a working wget and unxz or at least a way of copying the uncompressed .tar file or its contents onto your target server (perhaps just scp -r once you've extracted it locally):

# Ensure dependencies
sudo apt -y install make tar xz-utils wget

# Make a place to build it in
mkdir -p ~/src
cd ~/src
wget https://launchpad.net/ubuntu/+archive/primary/+sourcefiles/ca-certificates/20210119~20.04.2/ca-certificates_20210119~20.04.2.tar.xz    
tar -xJf ca-certificates_20210119~20.04.2.tar.xz

# Now build and install
cd ca-certificates-20210119~20.04.1
sudo make install

# You might want to run this interactively to ensure
# you can select the ISRG Root X1
# in which case, just run: sudo dpkg-reconfigure ca-certificates
sudo dpkg-reconfigure -fnoninteractive ca-certificates
sudo update-ca-certificates
/usr/bin/c_rehash /etc/ssl/certs
  • 2
    This answer was very helpful. First, in sbin/update-ca-certificates, I had to change openssl rehash to c_rehash (I studied an older version of ca-certificates). I also had to do dpkg-reconfigure ca-certificates (interactively) to enable the Let's Encrypt ISRG X1 certs. Then I did update-ca-certificates --fresh --verbose. Make sure /etc/ssl/certs has some ISRG Root X1 symlinks. Oct 1 '21 at 8:29
  • 1
    @daniel-buckmaster; check a couple of things... Do you have ls -l /etc/ssl/certs/ISRG_Root_X1.pem if you don't, then try the interactive dpkg-reconfigure suggested above. If you do, ensure you don't have /etc/ssl/certs/DST_Root_CA_X3.pem (the expired cert) - again you can interactively deselect it in dpkg-reconfigure ca-certificates. What openssl library is curl using? Run curl -V and it will show you. Hopefully it's a 1.0.x like OpenSSL/1.0.1f and not a OpenSSL/0.9.7
    – jaygooby
    Oct 1 '21 at 8:47
  • 1
    I followed all the steps above, but curl was still complaining. In my case, openssl c_rehash command was failing in the update-ca-certificates script. I tried force reinstalling the openssl apt package but that didn't help. What finally solved my problem is cd /etc/ssl/certs then running the rehash script directly: /usr/bin/c_rehash.
    – ttk
    Oct 1 '21 at 19:52
  • 1
    Let's Encrypt have an announcement page with links to resources. Oct 12 '21 at 11:41
  • 5
    If you want to make less changes and only remove the expired certificate (workaround 1 suggested by OpenSSL), you can run these commands: cp /etc/ca-certificates.conf /etc/ca-certificates.conf.orig cat /etc/ca-certificates.conf.orig | sed 's|mozilla/DST_Root_CA_X3.crt|!mozilla//DST_Root_CA_X3.crt|g' > /etc/ca-certificates.conf dpkg-reconfigure -fnoninteractive ca-certificates Oct 12 '21 at 11:41

Not the answer you're looking for? Browse other questions tagged or ask your own question.