unable to check site, maybe letsencrypt cert related

[digininja]

Yesterday I changed my site from using a commercial cert to using one from LetsEncrypt, this morning I get an error saying that my site can no longer be verified. I've checked and the site is definitely up and the file that you used to access is still there

When I tell you the URL you hit the site on http and I send you a 302 to the https site, you don't hit that and on screen show me this error:

"could not query digi.ninja. Are you running a site there?"

My guess is that you don't accept the LetsEncrypt certificate, can you check that and if not, add it to your certs list.

[maxtaco]

Yeah, that's indeed the problem. We're using Node's list. In particular, we're on 4.2.3 LTS Argon, whose list is the slightly older.

[digininja]

Glad there is a definite reason. I've done the confirmation through DNS so I'm OK for now, will look at adding web as well once you've fixed it.

[maxtaco]

Sounds good, thanks for the feedback and bug report. We'll wait a little bit to see if the node people fix it and if not we'll submit a P/R or patch. Thanks!

[maxtaco]

BTW, there's not an issue for this, but there is a higher level discussion as to how they manage their CA list.

[digininja]

Does seem like an odd decision.

On 7 January 2016 at 14:01, Maxwell Krohn notifications@github.com wrote:

BTW, there's not an issue for this, but there is a higher level discussion
nodejs/node#4175 as to how they manage their
C/A list.

—
Reply to this email directly or view it on GitHub
#1950 (comment)
.

[nomis]

Your server is missing the Intermediate Certificate "Let's Encrypt Authority X1" required to chain to a Root Certificate that could be accepted.

[digininja]

I thought I'd got the intermediates in and it works fine through browsers.
I'll have a look and see what I've missed.

On 13 January 2016 at 22:26, Simon Arlott notifications@github.com wrote:

Your server is missing the Intermediate Certificate "Let's Encrypt
Authority X1" required to chain to a Root Certificate that could be
accepted.

—
Reply to this email directly or view it on GitHub
#1950 (comment)
.

[kmkaplan]

Since PR nodejs/node#9139 was merged you can use NODE_EXTRA_CA_CERTS to manage root certificates.

[digininja]

Its all working and registered so closing this