# אישור Let's Encrypt לא התחדש אוטומטית

**URL:** <https://meta.discourse.org/t/lets-encrypt-certificate-did-not-automatically-renew/205186>\
**Category:** Product Support\
**Created:** [4 באוקטובר,‏ 2021,‏ 7:38pm UTC](https://meta.discourse.org/t/lets-encrypt-certificate-did-not-automatically-renew/205186 "2021-10-04T19:38:00Z")\
**Posts on this page:** 1\
**Showing post:** 12

<div class="post-metadata">

**Author:** ![JimPas](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jimpas/32/148179_2.png) [@JimPas](https://meta.discourse.org/u/JimPas)\
**Post date:** [5 באוקטובר,‏ 2021,‏ 12:04am UTC](https://meta.discourse.org/t/lets-encrypt-certificate-did-not-automatically-renew/205186/12 "2021-10-05T00:04:00Z")

</div>

> [@alexwoolfson](#):
>
> It’s still not showing with a valid date in Chrome, even after I deleted my browsing cache

I’ve seen a couple of cases where one had to clear the cache and restart Chrome before it showed the valid certificate.

> [@pfaffman](#):
>
> It can be difficult to get `<some browsers>` to report the correct cert, sometimes

Some browsers have a chain of trust cached which includes the old X1 leaf certificate - which LetsEncrypt has ended. They’ll “choke” when they get to that old cert and find it expired. 🤨  
The predicament: Updated browsers are happy with the new shorter chain of trust whereas older browsers still want the longer chain of trust. It’s all about updating everything for more security.

One way of updating your server using acme.sh v3.0.1+ to use the preferred chain of trust is:

[Preferred Chain · acmesh-official/acme.sh Wiki · GitHub](https://github.com/acmesh-official/acme.sh/wiki/Preferred-Chain)

Set the shorter ISRG preferred chain system wide by default with letsencrypt and then renewing all certificates

```plaintext
acme.sh --upgrade
acme.sh --set-default-chain --preferred-chain "ISRG" --server letsencrypt
acme.sh --renewAll --force

```

This is actually one of the very few times that the `--force` flag is appropriate.  
Beware though… older browsers may refuse the shorter chain of trust and will insist on getting the cert. This can also be downloaded as an alternate chain of trust. I believe Lets Encrypt has a link expressly for that purpose. I’ll hop on over there, get that and post it here.

---

_[View the full topic](https://meta.discourse.org/t/lets-encrypt-certificate-did-not-automatically-renew/205186)._