DST Root CA X3 cert expired

[daemonserj]

dot-ch won't work with Android 10. DST Root CA X3 certificate expired 30.09.2021 I've attached all certs from handshake, if it needs I can provide full tcpdump.

[daemonserj]

certs.zip

[daemonserj]

It seems it's LetsEncrypt issue. What can you advise?

[LogicaBorealis]

I can confirm the issue. BlahDNS is broken on Android 11 and 9 as well. I did not take the time for in-depth investigation but it seems consistent with the certificate problem you describe.

[daemonserj]

LetsEncrypt community discussion

[zoonderkins]

@daemonserj @LogicaBorealis

Switched from Let's Encrypt to ZeroSSL Now everything on Switzerland server should be okay. I will replace the others Server once I get off work.

kdig example.com +tls +tls-host=dot-ch.blahdns.com +tls-ca -d @dot-ch.blahdns.com
;; DEBUG: Querying for owner(example.com.), class(1), type(1), server(dot-ch.blahdns.com), port(853), protocol(TCP)
;; DEBUG: TLS, imported 129 system certificates
;; DEBUG: TLS, received certificate hierarchy:
;; DEBUG:  #1, CN=dot-ch.blahdns.com
;; DEBUG:      SHA-256 PIN: cxti1XR6uW483xAioP3d1ZaoGSy+obY6WaE4fW1A6Nk=
;; DEBUG:  #2, C=AT,O=ZeroSSL,CN=ZeroSSL RSA Domain Secure Site CA
;; DEBUG:      SHA-256 PIN: R3hcMOAGw0WFztuG2skTodoHp8IGid3Qg63Cn7YUYoM=
;; DEBUG:  #3, C=US,ST=New Jersey,L=Jersey City,O=The USERTRUST Network,CN=USERTrust RSA Certification Authority
;; DEBUG:      SHA-256 PIN: x4QzPSC810K5/cMjb05Qm4k3Bw5zBn4lTdO/nEW/Td4=
;; DEBUG: TLS, skipping certificate PIN check
;; DEBUG: TLS, The certificate is trusted.
;; TLS session (TLS1.3)-(ECDHE-X25519)-(RSA-PSS-RSAE-SHA256)-(AES-256-GCM)
;; ->>HEADER<<- opcode: QUERY; status: NOERROR; id: 37561
;; Flags: qr rd ra; QUERY: 1; ANSWER: 1; AUTHORITY: 0; ADDITIONAL: 1

;; EDNS PSEUDOSECTION:
;; Version: 0; flags: ; UDP size: 4096 B; ext-rcode: NOERROR

;; QUESTION SECTION:
;; example.com.             IN  A

;; ANSWER SECTION:
example.com.            86333   IN  A   93.184.216.34

;; Received 56 B
;; Time 2021-10-01 02:56:06 EDT
;; From 2a0e:dc0:6:23::2@853(TCP) in 0.1 ms

Tested from Oneplus 9 also working now.

[daemonserj]

For dot-ch problem fixed. Thanks!

[zoonderkins]

Should be fixed now, please try again 😄

[minoplhy]

wait, The expired one is DST Root CA X3 not ISRG Root X1

[LogicaBorealis]

Quickly fixed. Thank you!