Let's encrypt SslHandshakeFailedError

MartinD

Hi,
on some PCs, our Win Qt 5.7 32bit stopped communicating with our HTTPS server when our server's Let's Encrypt certificate renewed on Oct 1. The reason is probably https://letsencrypt.org/docs/dst-root-ca-x3-expiration-september-2021/

QNetworkReply::sslErrors returns "The issuer certificate of a locally looked up certificate could not be found".

How to fix this issue? Please note that CA certificate called ISRG Root X1 (as the webpage above mentions) is installed as CA certificate on the PC, along with old CA called DST Root CA X3.

Thanks for any advice.

SGaist

Hi,

Is your new certificate tied to the new intermediate ?

What if you remove the now defunct certificate ?

MartinD

@SGaist said in Let's encrypt SslHandshakeFailedError:

What if you remove the now defunct certificate ?

Our server's certificate is tied to R3 which is tied to ISRG Root X1 (as displayed using Chrome or Edge where we can access our HTTPS server on the same PC where Qt is not able to)

The removal of the expired CA certificate is not acceptable solution as we don't have access to clients's computers running our software. I have one PC with this problem in my hands but currently I don't want to delete the old CA certificate as it is possible that I won't be able to replicate the error any longer.

SGaist

I didn't mean that as a solution, just move it away temporarily to determine if it's the source of the issue you currently have.

MartinD

I understand this, but currently I don't want to delete the old CA certificate as it is possible that I won't be able to replicate the error any longer and I won't be able to find and verify permanent solution. Currently I have access only to a single PC with this issue.

This is wireshark log for the failed ssl handshake:

Frame 1256: 1010 bytes on wire (8080 bits), 1010 bytes captured (8080 bits) on interface \Device\NPF_{2001CBDC-C077-4984-B7E9-4DAA5A2A94EF}, id 0
Ethernet II, Src: Tp-LinkT_69:cc:a0 (d8:0d:17:69:cc:a0), Dst: IntelCor_a0:01:77 (f0:9e:4a:a0:01:77)
Internet Protocol Version 4, Src: 46.28.106.40, Dst: 192.168.1.158
Transmission Control Protocol, Src Port: 443, Dst Port: 52661, Seq: 4097, Ack: 518, Len: 956
[3 Reassembled TCP Segments (4374 bytes): #1253(2845), #1254(1176), #1256(353)]
Transport Layer Security
    TLSv1.2 Record Layer: Handshake Protocol: Certificate
        Content Type: Handshake (22)
        Version: TLS 1.2 (0x0303)
        Length: 4369
        Handshake Protocol: Certificate
            Handshake Type: Certificate (11)
            Length: 4365
            Certificates Length: 4362
            Certificates (4362 bytes)
                Certificate Length: 1667
                Certificate: 3082067f30820567a003020102021203777f7da54e0c1fc0a5099e2c227d84a325300d06… (id-at-commonName=domain.com)
                Certificate Length: 1306
                Certificate: 30820516308202fea003020102021100912b084acf0c18a753f6d62e25a75f5a300d0609… (id-at-commonName=R3,id-at-organizationName=Let's Encrypt,id-at-countryName=US)
                Certificate Length: 1380
                Certificate: 3082056030820448a00302010202104001772137d4e942b8ee76aa3c640ab7300d06092a… (id-at-commonName=ISRG Root X1,id-at-organizationName=Internet Security Research Group,id-at-countryName=US)
Transport Layer Security
    TLSv1.2 Record Layer: Handshake Protocol: Server Key Exchange
        Content Type: Handshake (22)
        Version: TLS 1.2 (0x0303)
        Length: 589
        Handshake Protocol: Server Key Exchange
            Handshake Type: Server Key Exchange (12)
            Length: 585
            EC Diffie-Hellman Server Params
    TLSv1.2 Record Layer: Handshake Protocol: Server Hello Done
        Content Type: Handshake (22)
        Version: TLS 1.2 (0x0303)
        Length: 4
        Handshake Protocol: Server Hello Done
            Handshake Type: Server Hello Done (14)
            Length: 0

You can see that the certificate chain is the same as Edge or Chrome displays (mydomain.com -> R3 -> ISRG Root X1)

SGaist

I am not asking you to delete the file, just move it out of the machine CA folder. You can always put it back after that.

By the way, what are you using to connect to that site ?

mbruel

Hi @MartinD
Kind of got the same issue on Qt v5.8.0 Linux cause it is built with OpenSSL v1.0. (cf my thread)
I guess the only solution is to switch to a more recent version of Qt that uses OpenSSL 1.1.
If you can't, just could add an exception in your code to allow QSslError::CertificateExpired... cf here the handshake works at the end, there is just an error that is raised.