'Certificate has expired' error for Let's Encrypt certificates (DST Root CA X3 issued)

[felipeabou]

Is there an existing issue for this?

• I have searched the existing issues

Describe the Issue

I've seen that this problem has happened before: #8589

The problem started today. Postman says the SLL certificate is expired, but it's not:

We use Letsencrypt to deal with SSL on our APIs and believe it could have something to do with this: https://letsencrypt.org/docs/dst-root-ca-x3-expiration-september-2021/

By now, I'm using the disable “SSL certificate verification” workaround.

This problem happened with version 9.0.3 and also with version 8~, because I tried to rollback to solve it, with no luck.

Also, when using the Postman Web, the issue is not happening. It only happens with the Native App version.

Steps To Reproduce

1. Try to hit any API that uses Letsencrypt to deal with SSL certificates.

Screenshots or Videos

Postman error:

Checking the same SSL on Chromium:

Environment Information

- Operating System: Ubuntu 20.02
- Platform Type: Native App
- Postman Version: 9.0.3

Additional Context?

No response

[adamsommer]

+1

- Operating System: macOS 10.15.7
- Postman Version: 9.0.3

[numaanashraf]

Postman v8 and v9 seems to be impacted by the recent cert expiry https://letsencrypt.org/docs/dst-root-ca-x3-expiration-september-2021/. We are investigating this now.

[numaanashraf]

As a workaround, please turn off SSL verification via Settings > General.

[amurrell]

+1

also using lets encrypt and valid certs till nov 1st - acting up today. Upgraded to latest postman version and it's still not working. Disabled ssl verification for now.

[taconi]

+1

• OS: Ubuntu 21.04
• Kernel Release: 5.11.0-37-generic
• Postman Version: 8.12.2

[idkw]

Same :

• OS : Linux Mint 20
• Kernel : 5.4.0-88-generic
• Postman : 8.11.1

[Ray-B]

+1

• OS: Big Sur 11.6
• Postman: 9.0.3

[numaanashraf]

Thanks for your patience everyone. We have identified the issue and are testing out a potential fix internally. Once we have the fix verified, we'll release a patch on our v8.x and v9.x release lines.

[trixie88]

+1
postman V: 9.0.3

[mikeamcbrien]

+1

• OS: Big Sur 11.6
• Postman: 9.0.3

[danielgelling]

Also on:

• Postman Version 8.12.1
• OS X 20.6.0 / x64

[Freyert]

The LetsEncrypt expiration is a bit confusing because the expired certificate is left in the chain for backwards compatibility purposes from what we've read on their blog.

So there are two paths for the certificates, the new shorter valid path, and the longer expired path.

That is to say the issue is likely not that the trust store is missing a certificate, but that postman is ignoring the valid certificate path.

Update:

If postman is using a version of NodeJS older than 5 years it's likely they don't have the ISRG Root X1 in the trust chain.

https://github.com/nodejs/node/blame/master/src/node_root_certs.h#L2602-L2631

If someone wants to try you can extend the built in certificates via the environment variable NODE_EXTRA_CA_CERTS nodejs/node#9139

Update 2:

I've tried manually adding the CA for ISRG Root X1 from NodeJS to no avail. It's likely a conflict in the TLS resolution paths. If you want to try yourself just copy and paste the certificate I linked here into a file ending with .pem and import it into postman as you are accustomed to.

I don't know much about Postman so maybe someone can figure out how to get more details from there or correctly configure the certificate.

[numaanashraf]

@Freyert Postman uses Electron, which has a non-standard Node + BoringSSL integration. We believe this is happening cuz boringSSL is not configured to prefer the shorter part by default. We have patched this internally and is also working on upstreaming this.

electron/electron#31213