Solved Google Chrome 101 SSL certificates ERR_CERTIFICATE_TRANSPARENCY_REQUIRED

My day has started with reports of just-updated-to-version-101 Chrome users unable to connect to SSL sites (running Apache on FreeBSD). Not sure if only GoDaddy certificates but think it is other CAs.

The error is:

ERR_CERTIFICATE_TRANSPARENCY_REQUIRED

It seems to affect any certificate issued a couple of years ago and coming up close to expiry.

From https://news.ycombinator.com/item?id=31239883

The response I got from Godaddy and worked for us:
Chrome retired some CT logs on May 1st. For OLD certificates, that is ones issued sometime before June 2020, they might contain SCTs that have now all been retired by Google. Normally this should not be an issue, but if ALL the SCTs on a certificate are now retired, then the it looks like the most recent version of Chrome will not trust it.

You need to rekey the SSL by generating a new CSR from hosting plan and then you need to upload the new SSL files in the hosting plan please.


Just posting this in case any of you hit the issue - might save you a bit of head-scratching!
 
When I called GoDaddy I got the same "re-key" etc. advice but found it wasn't necessary to do all that. If anyone knows that I should have done that, please advise!

I renewed the SSL certificates, paid for them, downloaded the new files, amended the Apache config, and then

Code:
apachectl configtest
apachectl graceful

And Chrome 101 started being happy again. YMMV!
 
Back
Top