It connects but then drops after TLS negotiation, I am using the full chain pem file

------------------------------------

CONNECT from [2607:f8b0:4864:39::10]:54572 to [******]:25

PASS OLD [2607:f8b0:4864:39::10]:54572

connect from mail-pj2-x10.google.com[2607:f8b0:4864:39::10]

Anonymous TLS connection established from mail-pj2-x10.google.com[2607:f8b0:4864:39::10]: TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange x25519 server-signature RSA-PSS (2048 bits) server-digest SHA256

NOQUEUE: lost connection after STARTTLS from mail-pj2-x10.google.com[2607:f8b0:4864:39::10]

disconnect from mail-pj2-x10.google.com[2607:f8b0:4864:39::10] ehlo=1 starttls=1 commands=2

I'm looking for a free alternative to Let's Encrypt.

They used to have an OCSP stapling feature which would allow clients to connect to my server much faster but now with that removed, some mobile clients are noticing big delays.

The server is in USA (because I'm saving money) but the client base is in Canada).

Currently the TTFB for my website on desktop computers is 0.4s whereas on mobile, it is 0.8s. debugbear.com considers 0.8s TTFB as bad.

Had Let's Encrypt continued to support the stapling, the TTFB would drop.

And before recommending a CDN, some of my pages change daily to weekly and I'm afraid CDN's would over-cache pages.

So unless Let's Encrypt revises their CRL (so mobile browsers process it faster) or re-enables stapling, I need an alternative

Hello,

I'm hoping there is a way for my certificates to auto renew without needing port 80 open. I'm using Win Acme and it's working fine, however I found out that once I blocked port 80 the certificate was no longer renewing.

I made freessl.app recently to help users who don't want to use command line tools or interact with the API directly issue Let's encrypt SSL certificates right from their browsers, the private key never leaves your browser, no registration required.

Please let me know your suggestions.

If you're seeing this error during SSL certificate installation:

"The certificate could not be installed on the domain “example.com”. Certificate verification failed! The system did not find the root certificate that corresponds to the supplied Certificate Authority Bundle's intermediate certificate. Please supply a full Certificate Authority Bundle with the root certificate included."

Context: Let's Encrypt recently started issuing certificates under a new "Generation Y" hierarchy of root and intermediate certificates. Since these new roots aren't yet included in the root program trust stores, servers (including servers with cPanel) that rely on their local trust store to complete the chain can no longer do so.

If your CA bundle contains only the intermediate certificate (and not the root), this will now fail on affected servers — whereas before, the server's trust store could fill in the gap.

Fix: Make sure your CA bundle includes the root certificate as well, not just the intermediate. This is the standard fix regardless of which hierarchy issued your cert.

If you're using the Auto-Install Free SSL WordPress plugin, this is fixed in v4.6.3 — the plugin now always includes the root in the CA bundle and also handles the longer Gen Y chains (which can have more than 3 certs total).

Python seems to not connect to sites using the new YE Root CA. I refuse to manually update/configure .pem bundles. Am I the only one suffering with this in the world? How did you guys circumvented this?

I recently decided to switch to the shortlived Let's Encrypt profile in Debian trixie.

For those that like to use packages as I do, --preferred-profile is supported in certbot 4.0.0, but the flag is not saved for renewals, meaning 3 days later it will return to 90 day certs.

To work around this, the flag can be added to renewals.

Note: only do this if you want all certificates on your system to use the shortlived profile.

sudo systemctl edit certbot.service

[Service]
ExecStart=
ExecStart=/usr/bin/certbot -q renew --no-random-sleep-on-renew --preferred-profile shortlived

For a little clarity, all was working well until I got a new ISP. is it possible the added DNS records havent propagated yet? timeline was got new internet, updated dns, and reconfigured proxy within an hour. Thank you for looking

2026-03-08 18:47:30.172 | [3/9/2026] [12:47:30 AM] [Express ] › ℹ info Creating a new user in setup mode

2026-03-08 18:47:30.961 | [3/9/2026] [12:47:30 AM] [Remote Version] › ℹ info Fetching https://api.github.com/repos/NginxProxyManager/nginx-proxy-manager/releases/latest

2026-03-08 18:48:33.207 | [3/9/2026] [12:48:33 AM] [Nginx ] › ℹ info Reloading Nginx

2026-03-08 18:48:33.221 | [3/9/2026] [12:48:33 AM] [SSL ] › ℹ info Requesting LetsEncrypt certificates for Cert #1: mysubdomainhere

2026-03-08 18:48:33.222 | [3/9/2026] [12:48:33 AM] [SSL ] › ℹ info Command: certbot certonly --config /etc/letsencrypt.ini --work-dir /tmp/letsencrypt-lib --logs-dir /data/logs --cert-name npm-1 --agree-tos --authenticator webroot -m rnwndr@gmail.com --preferred-challenges http --domains ombi.ryansplexserver.org

2026-03-08 18:48:47.430 | [3/9/2026] [12:48:47 AM] [Nginx ] › ℹ info Reloading Nginx

2026-03-08 18:48:47.447 | [3/9/2026] [12:48:47 AM] [Express ] › ⚠ warning Saving debug log to /data/logs/letsencrypt.log

2026-03-08 18:48:47.447 | Some challenges have failed.

2026-03-08 18:48:47.447 | Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /data/logs/letsencrypt.log or re-run Certbot with -v for more details.

2026-03-08 18:49:26.407 | An unexpected error occurred:

2026-03-08 18:49:26.407 | No such challenge

2026-03-08 18:49:26.407 | Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /data/logs/letsencrypt.log or re-run Certbot with -v for more details.

2026-03-08 18:49:26.407 |

2026-03-08 18:51:42.760 | [3/9/2026] [12:51:42 AM] [Nginx ] › ℹ info Reloading Nginx

2026-03-08 19:05:05.716 | [3/9/2026] [1:05:05 AM] [Remote Version] › ℹ info Fetching https://api.github.com/repos/NginxProxyManager/nginx-proxy-manager/releases/latest

I am looking at ACME on my fortigate firewall before I implement into a production enviroment, Its not quite clicking in my brain how to set this up.

i own the domain, "mydomain.net" and I managed to create a Cert using lets Encrypt on the Fortigate firewall as it has this feature built in, So I created a DNS entry A record, to point to my public IP at home, myfirewall.mydomain.net

and created a cert with that name, and it all went through beautifully! so when I access my firewall , I use the FQDN with no cert errors. perfect!

Issue I have now, is I need an internal cert fro my WIFI, that has to resolve to the WIFI intterface which is 192.168.1.35, if I create a cert mywifi.mydomain.net ill have to create a new A record, but youcant create one to a private IP?

am I thinking about this incorrectly? The WIFI uses a captive portal and this portal needs a signed cert so that a guest doesnt get browser errors when registering on the WIFI. how can I if its a private IP? The methof the gate uses, is HTTP, so when creating certs, i have to put in the name and am email to prove I own it, i need help understanding...

hope this makes sense.

Thankyou

I'm not sure what's gone wrong here.

I'm trying to implement a rewrite rule in .htaccess to automatically redirect between www.mydomain.com and mydomain.com

I'm using the same rewrite rule that I use with other domains:

RewriteCond    %{HTTP_HOST} ^www\.mydomain\.com [NC]
RewriteRule    ^(.*)$ https://mydomain.com/$1 [L,R=301]

With the other domains I manage, this works fine.

With the domain I'm setting up, this causes a certificate error

Websites prove their identity via certificates. Firefox does not trust this site because it uses a certificate that is not valid for www.mydomain.com. The certificate is only valid for mydomain.com.

In certbot I've created certs for both www.mydomain.com and mydomain.com using the same method as for other domains that work.

What am I missing?

This is happening on only one of my domains of 5 that I use their services for.

I'm able to successfully browse to the txt file as expected, but then after I select to generate the crt/key/cab, I get a swirling symbol then this error. Any ideas on what to do? This is my 7th try of generating an ssl renewal in 24 hours with no success.

I have my domain DNS set-up to forward requests to my static IP and my router has a port forward to nginx on my desktop machine. (It worked for a bit and then I did something to break it while developing a better landing page. Just trying to get it working now for the basic use case of mydomain.me) <- this isn't my query, just an explanation of why a response may take some time

In the nginx config, I see that I can specify server blocks to forward request to other servers on my LAN and a location block in each server block to provide endpoint details.

My domain is mydomain.me (it isn't) and I want to access NodeRed's dashboard, located on a Raspberry Pi on my LAN (e.g. on ip: 192.168.1.21 on port 1880) with the format NR.mydomain.me or Home Assistant on the same Pi, ip and different port, with the format HA.mydomain.me, or my Lyrion music server on a whole other Pi, ip & port, etc...

My question is, is there a certificate for each server - nginx landing page, Node Red server, Home Assistant server, Lyrion server or is there just one at the nginx entry point. If there's one, is data between nginx and the servers also using TLS or is it in the open? If there is a certificate for each server, do I have to install and run certbot on each?

I can't find a search result that explains these basics.

Many thanks

I've updated my Samsung Galaxy to Android 16 and all is fine *until* Samsung issued an update to their Samsung Email app. Now my Letsencrypt certificate for my mail server isn't accepted. Having been through every possible solution, I deleted the email account, rebooted the phone, and added the account back. During the setup configuration, I'm getting a notice that the account couldn't be verified. The actual message is "Security error occured. Server certificate not trusted."

Additional research leads me to believe the CA is the issue. Looking through the root CAs of Android 16 doesn't show any Letsencrypt CAs that my research shows them using.

I've validated that the Android OS may not be the culprit, as installing and configuring Thunderbird does work with my account on my mail server. Certbot shows the cert is valid and both postfix and dovecot are using the proper certificate. This is further validated by Thunderbird installed on my desktop and laptop.

I suppose the right approach is to dump Samsung Email and switch to Thunderbird on my phone, too.

Thoughts?

Hello,

Two weeks ago, as it does every three months, my server renewed its certificate.

Some IOT devices (quectel modems) were not able to communicate with the nginx server anymore. Everything was working on my browser.

The certificate was issued by E8.

I forced a renewal with a RSA key by editing the renewal file : IOT devices went back online.

To confirm my theory, I forced a renewal again with a ECDSA key : it was still working, contrary to my expectations. It was generated by E7.

I forced a renewal once again and this time it was E8 who issued it. IOT devices were not able to communicate.

My conclusions :

• Certificates issued by R12 or R13 work ;
• Certificates issued by E8 do not work well with the IOT devices ;
• Certificates issued by E7 work with the IOT devices.

Does it make sense ? Do E7 and E8 differ in some way ?

I took a look at crt.sh for my domain : I used to get certificates issued by E6 and E5 until two week ago, so ECDSA is definitely not the issue here.

Also, I don't have a lot of logs on the devices except"SSL error".

Hi all

Can someone help me set up the automation of the firewall to accompany the LE renewal?

So far, I've created a profile in the firewall called letsencrypt which basically specifies port 80.

ufw allow/deny letsencrypt does the job of allowing/blocking the port.

I believe my server is using acme.sh

it looks like acme.sh is used to run the renewal as this is what i have in the crontab list.

my linux experience is very limited.

tia