As of Friday 1st October 2021, we've become aware of an issue impacting sites that use the LetsEncrpyt SSL certificate - this is due to their certificate expiring however it is a certificate used by a vast array of websites so you are likely to encounter issues.
Below is what you will see if this is the issue:
Please do the following to resolve
For users on Ubuntu 16.04 (USS Gateway version 1.1.x/1.2.x)
1. Log into your USS Gateway via Putty or Virtual Machine. Then run the following commands
sudo su |
apt-get update |
apt-get -y dist-upgrade |
nano /etc/ca-certificates.conf |
2. Within this file, please find the line that reads mozilla/DST_Root_CA_X3.crt and change it to !mozilla/DST_Root_CA_X3.crt (i.e. add the exclamation point at the beginning).
Save and exit by hitting CTRL+O and CTRL+X
3. Run the following commands
mv /usr/local/share/ca-certificates/Lets-Encrypt-R3.crt /root |
mv /usr/local/share/ca-certificates/DSTRootCAX3.crt /root |
If you receive an error at this point, it means that the certificate has been removed by the update performed in step 1 and you can just carry on with the steps
update-ca-certificates --fresh |
4. Finally, either reboot or restart the proxy process from the proxy UI
For users on Ubunutu 14.04 (USS Gateway version 1.0.x)
1. Log into your USS Gateway via Putty or Virtual Machine. Then run the following commands
sudo su |
nano /etc/ca-certificates.conf |
2. Within this file, please find the line that reads mozilla/DST_Root_CA_X3.crt and change it to !mozilla/DST_Root_CA_X3.crt (i.e. add the exclamation point at the beginning).
Save and exit by hitting CTRL+O and CTRL+X
3. Run the commands
mv /usr/share/ca-certificates/mozilla/DST_Root_CA_X3.crt /root |
update-ca-certificates --fresh |
4. Restart the squid process by running the following commands
/etc/init.d/uss-squid stop |
/etc/init.d/uss-squid start |