SSL certificate expiry issue on cardiodb.org

cardiodb.org uses an SSL certificate issued by Let's Encrypt. Our website has an SSL certificate (which is in date), which is effectively guaranteed by an underlying "root certificate" held by the certificate provider, Let's Encrypt. Before October 2021 Let's Encrypt changed this root certificate (moving from the DST Root CA X3 chain to ISRG Root X1).
However, there is a well known issue whereby some OS/browser combinations do not recognise the new certificate, attempt to find the old one, and report the chain as expired. We have no control of this behaviour. This appears more likely on older systems, or on a mac under certain circumstances.

The easiest routes to access cardiodb.org under these circumstances are

1. follow prompts to visit the site anyway (you can confirm that our certificate is in date), and add the site to your list of trusted locations.
2. Alternatively, use firefox which is not affected by this issue.

If you are encountering this problem on other sites that you use regularly, and would like to address the underlying issues, then more detailed information is provided below (from https://docs.certifytheweb.com/docs/kb/kb-202109-letsencrypt/).

For older macOS not updated by Apple

• Download the ISRG Root X1 certificate file from http://x1.i.lencr.org/.
• Open the Keychain Access app and drag that file into the System folder of that app.
• Find the ISRG Root X1 certificate in System and double click on it, open the Trust menu and change "Use System Defaults" to "Always Trust", then close that and enter your password to confirm the change (if prompted).

Windows PCs

On windows PCs, simply browsing to a website using Chrome, Edge etc with updated the client trust store with the required certificates. Browsing to https://valid-isrgrootx1.letsencrypt.org/ will prompt Windows to include ISRG Root X1 in its trust store automatically.

For Windows (with an outdated trust store) you can manually install ISRG Root X1:

• Browse to http://x1.i.lencr.org/ in order to download the .cer file for ISRG Root X1 (your browser may warn about the file type and you may need to click "Keep" to save the file).
• Open the file, click "Install Certificate..", Choose default option "automatically select..", Next, Finish
• Reboot

You should then find out why your Windows install is not updating certificate authorities automatically (the default behaviour).

Last updated

This statement was last updated on 11/11 2021.