On 30 May 2020, the root certificate of the Sectigo Certification Authority expired

On 30 May 2020, the validity of the root certificate AddTrust External CA Root from Certification Authority Sectigo (formerly Comodo) expired, as well as intermediate certificates USERTrustRSA and Comodo RSA CA, signed by this root certificate. 

If you have a problem with Sectigo or Comodo certificates, a reissue is not required. You need to replace the chain. The chain is slightly different depending on the certificate, so you can send a request to us at info@leadertelecom.nl, indicating your domain and type of software - and we will send you the correct chain.

If you have not found any problems with your certificates, no action will be required from you. 

AddTrust External CA Root was used in chains to support legacy devices where the USERTrustRSACA root certificate has not yet been enabled.

The expiry of the AddTrust External CA Root certificate meant the end of support for legacy systems – for example, Windows® XP, iOS9, Android 2.3 – but at the same time, there was a second current chain that is supported by all modern systems:

After the expiry of AddTrust, problems with signing verification emerged for OpenSSL 1.0.x, GnuTLS and LibreSSL clients that do not use browsers where scripts are accessed via HTTPS, i.e. by API.

When using a browser, no errors occur.

Sectigo previously assured that there would be no problems at the end of AddTrust, but problems still arise.

Actual chains are:

Repeat for clarity:

If you have a problem with Sectigo or Comodo certificates, a reissue is not required. You need to replace the chain. The chain is slightly different depending on the certificate, so you can send a request to us at info@leadertelecom.nl, indicating your domain and type of software - and we will send you the correct chain.

If you have not found any problems with your certificates, no action will be required from you.