SSL Signing Error with Free SSL/Lets Encrypt

Hosting Support
1

Username (e.g. epiz_XXX) or Website URL

epiz_26514228
(please specify the website or account you are asking about)
www.leaf-linux.com

Error Message

Squid Proxy Server Error that the certificate has not been signed by the issuer.
(please share the FULL error message you see)

Squid 4.10 Error
Failed to establish a secure connection to 185.27.134.139

The system returned:

(71) Protocol error (TLS code: X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY)

SSL Certficate error: certificate issuer (CA) not known: /C=US/O=Let’s Encrypt/CN=Let’s Encrypt Authority X3

This proxy and the remote host failed to negotiate a mutually acceptable security settings for handling your request. It is possible that the remote host does not support secure connections, or the proxy is not satisfied with the host security credentials.

DigiCert also returns an error for this free SSL certificate:

TLS Certificate is not trusted

The certificate is not signed by a trusted authority (checking against Mozilla’s root store). If you bought the certificate from a trusted authority, you probably just need to install one or more Intermediate certificates. Contact your certificate provider for assistance doing this for your server platform.

Other Information

This error is returned when going through a proxy server to the remote website (leaf-linux.com). Digicert is reporting that the certificate has not been signed by the issuer. This is what I got after requesting a free SSL certificate. I have previously used Let’s Encrypt via getssl and it always worked correctly. Can you explain this. Thanks.
(other information and details relevant to your question)

2

Are you trying to get SSL from Infinityfree’s client area or somewhere else?

By the way Welcome to the forum

3

Hey @jeffmerkey,

Your domain has a valid SSL certificate by Lets Encrypt.
image

Seems that your website is ok.

1 Like
4

Certificate chains are not supported on free hosting natively, so some devices or proxy servers will have an error while trying to access your website through HTTPS. Use Cloudflare’s Full SSL mode to fix that problem and have a working certificate with a certificate chain. Also, I suggest enabling Always Use HTTPS mode for forcing HTTPS with Cloudflare.

4 Likes
5

I used the online panel from the main infinityfree login to request a free SSL certificate from the Infinity free system. I created the CNAME records, copied them, then waited for DNS to update, then I requested the certificate from panel 2, then it appeared to automatically install it on my domain in panel 3. You can verify the issued certificate from leaf-linux com by going to digicert.com/help and entering the leaf linux domain. It reports a TLS cert invalid error because the certificate was not properly signed by Let’s Encrypt.

2 Likes
6

he needs to force https

7

no, it’s broken if you go through a proxy server. The proxy reports an error. It works if you are not using a proxy server.

8

You may force https by adding this code to your domains .htaccess file.

RewriteEngine On 
RewriteCond %{HTTPS} off 
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
2 Likes
9

I already have php code that will force it to https. I will go enable it. I turned it off because I was getting this error through the proxy server. I am running squid4.10

1 Like
10

It might need some time for the changes to be seen. Try clearing your caches.

11

The latest is squid 4.13, Lets encrypt may not be installed with their certificates in the older version, please update squid to recieve new root ca’s. Or your computer is missing the root certificates

1 Like
12

No, TLS is not dependent on the cache. The proxy server is reporting that the certificate is invalid. Digicert also reports the certificate is invalid. That is because THE CERTIFICATE IS INVALID. The certificate is invalid because it has not been signed by the issuer. It happens to work on some browsers because they are not requiring it be signed. Squid will throw an error because the certificate issued for that site fails verification. If Infinityfree is going to issue certificates like this, they need to make certain they have been signed by Let’s Encrypt. The certificate on my website, which was issued by the automated infinityfree website is invalid. This means most proxy servers with virus detection and content filtering will not trust it and throw this error.

13

Your site is loading securely and fine using the latest versions of Edge, Chrome and Firefox browsers.

14

connect through a squid proxy server with ssl bumping enabled to support virus scanning, and watch it crash. Also, I have said it before go and lookup the leaf linux website on digicert.com/help and enter the URL. It reports the CERTIFICATE IS INVALID.

15

Please refer to Ergastolator’s reply.

1 Like
16

Look, simply put, either the free certificates work or they don’t. “Working” is defined as the certificate being accepted as valid in accordance with accepted SSL/TLS standards. If digicert/help throws errors, the free certificate is BROKEN. One reasonable standard which seems really simple is to get the certificate actually SIGNED by Let’s Encrypt. The certificate is UNSIGNED, which means it FAILS in actual real time use. Why do I need a certificate chain for an advertised FREE certificate. What the site issues should pass even the most simple validation steps.

1 Like
17

The problem isn’t on the your free ssl certificate. It’s problem of the server. And as Ergastolator explained: if you enable cloudflare through your cPanel that will fix the issue.

1 Like
18

TLS Certificate is not trusted
The certificate is not signed by a trusted authority (checking against Mozilla’s root store). If you bought the certificate from a trusted authority, you probably just need to install one or more Intermediate certificates. Contact your certificate provider for assistance doing this for your server platform.

It was signed already but it only lacks of Certificate Chain and Root Certificate. Chain Certificate are still not supported. Just like everybody said.

2 Likes
19

OK, I enabled Cloudfare. I got a message that it takes some amount of time for it to be active. So far, it’s still busted. I just checked.

1 Like
20

If you get any website hosted on the free hosting network and with a valid ssl certificate you will always get the same error as the problem is on servers certificate and not your site’s. The ssl certificate tool of InfinityFree works fine.

You get this hosting for free but others pay for it. You must understand this. There are multiple servers in the free hosting network and much money would needed for that TLS certificates.

You may upgrade to premium if you want to that support’s Chain Certificates and you won’t have problems like this.

1 Like