Search code examples
opensslcertificatelets-encrypt

OpenSSL certificate verify failed: Letsencrypt root expired


I develop a webapp on my local machine and use the mailtrap.io email testing service to check outgoing emails. I haven't changed anything, but a few days ago the mailtrap service gives back the below error message:

ErrorException stream_socket_enable_crypto(): SSL operation failed with code 1. OpenSSL Error messages: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed

Mailtrap advises the following:

Regarding SSL error while trying to send emails to Mailtrap You are not alone. Please update your OpenSSL version You might hear about the global issue with Letsencrypt certificates: its old root certificate expired on Sep 30. Mostly it impacted clients who use OpenSSL versions prior 1.1.0. The most common solution is to update your OpenSSL. If you can’t do that read the recipe for v.1.0.2 from OpenSSL.

Reading the linked article did not really help me to solve the problem.

In parellel I found this page explaining how to install some new certificates to avoid similar problems, but it did not help.

I also removed the expired certificate as described here, but still get the same error message.

I work on mac (Catalina 10.15.7) and now I'm thinking about somehow updateing the openssl on my machine. openssl version tells me that I have LibreSSL 2.8.3 on my machine.

Am I on the right track? Should I update LibreSSL to the latest version to solve this problem? How do I do that? Are there any side-effects? Is there a better solution to solve this problem?

Thanks for any advice, W.


Solution

  • Finally I could solve this issue without upgrading anything. The key point was to realize from PHPInfo that my PHP uses openSLL that is installed under my MAMP installation. I had to remove the expired DST Root CA X3 root certificate from the .pem file under this installation and now everything works correctly.