New let's encrypt error: SSL certificate problem: unable to get local issuer certificate [RESOLVED]

FreePBX Security
5

@wzkds We came across the same issue. Looks like the issue is not a module error, the error comes from curl, and it will happen with any connection from the PBX in question to a site with a LE certificate. The CA bundle on FPBX13 seems to be from 2015, and does not have the latest LE Root CA (probably still referencing to the one they decommissioned not too long ago). FPBX13 is EOL and is not getting updates any longer.

To mitigate this:

  1. SSH into the PBX, and run rm /etc/pki/tls/certs/ca-bundle.crt to remove the symlink to /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem (provided by the CA-certificates package).

  2. Once the symlink is removed, run curl https://curl.se/ca/cacert.pem -o /etc/pki/tls/certs/ca-bundle.crt -k.

    WARNING: -k disables certificate check because you don’t have certificate to check against at this moment. You can also download the file and upload to the PBX over SFTP if you prefer.

  3. To check if the new CA-Bundle works, run curl https://letsencrypt.com

NOTE: To undo what we just did, simply run ln -s /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem /etc/pki/tls/certs/ca-bundle.crt - this creates the symlink as it was before.

Hope that helps!

5 Likes