Subject: bug#50921: GNU ELPA TLS errors: server is returning chain with expired root

From: John Cummings <[email-masked]>
Date: Thu, 30 Sep 2021 20:47:38 +0000

John Cummings <[email-masked]> wrote:

> It appears that elpa.gnu.org is returning a certificate chain referring
> to a root certificate that expired today. (More info:
> https://twitter.com/letsencrypt/status/1443621997288767491) I don't know
> if GnuTLS is supposed to be able to work around this (Firefox seems to, for instance)

One possibility (and note here that I'm clearly not a TLS expert) is that
Firefox recognizes the intermediate cert "ISRG Root X1" as one that is also
now a trusted root cert, and so short circuits the rest of the chain,
ignoring the expired cross-signature. Is this something that is possible
and desirable to have Emacs do with GnuTLS?