Let's Encrypt: "unable to get issuer certificate" (error 2), forced reissuance and rate limits

Contribute Bug
5

Thanks @supermathie for looking into this. I’ve attached fullchain.cer and ca.cer from the affected instance.
fullchain.cer.txt (5.9 KB)
ca.cer.txt (3.8 KB)

The OpenSSL output below shows the original verification command failing with error 2, and -untrusted succeeding with the same certificate and chain.

openssl version
openssl verify -CAfile <(openssl x509 -in ca.cer) fullchain.cer
openssl verify -show_chain -untrusted ca.cer fullchain.cer

OpenSSL 3.5.7 9 Jun 2026 (Library: OpenSSL 3.5.7 9 Jun 2026)
C=US, O=Let's Encrypt, CN=YR2
error 2 at 1 depth lookup: unable to get issuer certificate
error fullchain.cer: verification failed
fullchain.cer: OK
Chain:
depth=0: CN=hubprod.surikai.fr (untrusted)
depth=1: C=US, O=Let's Encrypt, CN=YR2 (untrusted)
depth=2: C=US, O=ISRG, CN=Root YR (untrusted)
depth=3: C=US, O=Internet Security Research Group, CN=ISRG Root X1

I encountered this issue in two separate environments. I’ve been running the fix on my development instance since I opened the PR, and it has been working as expected.

2 Likes