Download the ISRG Root X1 certificate from the Let’s Encrypt website.To trust the ISRG Root X1 on older versions of Ubuntu, perform the following actions: It’s common name is ISRG Root X1 and must be trusted by the OS for certificate renewals to work with certbot. Older Ubuntu versions such as 14.04 do not have the newest Let’s Encrypt root. The error returned was the following: ('bad handshake: Error(,)',) What caused certbot automated renewals to break after the IdentTrust DST Root CA X3 expiration? certbot could no longer form a valid chain to the Let’s encrypt root at when making the API call for renewal. While end of life is not until April 2024, it is recommended to upgrade as soon as possible due to unsupported software packages, potential security holes, and the cause of this issue, an outdate certificate truststore.

According to, Ubuntu 14.04 ran out of standard support in April of 2019. The latest supported version of certbot on Ubuntu 14.04 is 0.22, far behind the latest version. With the expiration of the Let’s Encrypt root certificate, IdentTrust DST Root CA X3, on September 30, 2021, Ubuntu 14.04 certbot renewals broke.

How to install curl ubuntu 14.04