dst root ca x3 certificate has expired and I cannot access some websites on my Macbook Air from 2013.

Choose Utilities from the Finder's Go menu, open the Script Editor, and run:

do shell script "curl -k https://letsencrypt.org/certs/isrgrootx1.der > ~/Downloads/isrgrootx1.der"

Double-click the downloaded certificate.

(206216)

There seems a problem:-

curl -k https://letsencrypt.org/certs/isrgrootx1.der > ~/Downloads/isrgrootx1.der

  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current

                                 Dload  Upload   Total   Spent    Left  Speed

  0     0    0     0    0     0      0      0 --:--:--  0:00:04 --:--:--     0curl: (7) Couldn't connect to server

Google suggested I go to:-

https://discussions.apple.com/thread/253204711?login=true

but access to that appears restricted. I can't remember how to go to google's cache to read the whole page.

i did the curl thing above, then `open ~/Downloads/isrgrootx1.der`. It opens up KeyChain Access snd asks me what chain to add this to. I selected System, but it seems to have added it to login anyway. Didn't seem to help anything.

Any idea what might be the issue if after downloading, installing and setting the new certificate to "Always trust", then restarting the machine, Safari and Chrome still accessing the expired "DST Root CA X3"?

I searched in Keychain Access for "DST Root CA X3" filtering set to "All Items" in all four keychains I can see on the left hand side, "login", "Login Items", "System" and "System Roots", but nothing came up.

macOS 11.6.

Upgrade the OS, or use another browser, or click here, download the certificate, and open it in the Finder.

(205717)

This didn't work seeing as it won't let you access the link. The link itself has a privacy error connected to the DST Root. Any way to download it without having to get outside help?

Try the script again now. If it still doesn't work, check for problems on your local network.

(206447)

Set Keychain Access to always trust it.

(206694)

My fault was in installation of "DST Root CA X3" to Keychain, but site was using R3 as intermediate CA. After adding R3 certificate too, all works fine. https://letsencrypt.org/certificates/