voltone
On September 30th, the root CA certificate DST Root CA X3 will expire. Let’s Encrypt have started rolling out a creative certificate chain to servers that use their certificates, which unfortunately may trip up some Erlang/Elixir applications once that DST Root CA expires. This could lead to outages due to failed TLS handshakes on the connection between such applications and those servers/services. Recent versions of Erlang/OTP include a fix that prevent those issues.
If you run an application on the BEAM that may communicate over TLS with one or more servers/services that present a Let’s Encrypt certificate, the safest thing to do is make sure the application is running on Erlang/OTP 23.3.4.5 or later, or 24.0.4 or later. If that’s not an option, check out this post for other, client and OTP-version specific recommendations.
Keep in mind that, due to client connection pools and TLS session reuse, an affected application may continue to function normally until some time after September 30th when the first new TLS handshake takes place…
Edit - let me clarify, this is not about servers (e.g. Phoenix apps) that have a Let’s Encrypt certificate, it is about any application that connects to a server with a Let’s Encrypt certificate, e.g. through an HTTP client, an MQTT client, a higher-level API client that uses an HTTP client, etc. That could include Phoenix apps, but also CLI tools, CI/CD scripts, embedded devices, …
Where Next?
Trending in Discussions
Other Trending Topics
Latest on Elixir Forum
Sponsor Spotlight
Error tracking, logs, APM, uptime and cron monitoring in one dev-friendly platform. Find and fix problems before your users notice.
Categories:
Sub Categories:
Forums
Popular Tags
- #ecto
- #liveview
- #troubleshooting
- #learning-elixir
- #library
- #deployment
- #erlang
- #testing
- #genserver
- #mix
- #absinthe
- #remote-other
- #otp
- #plug
- #how-to-question
- #macros
- #postgres
- #elixirconf
- #channels
- #exunit
- #discussion
- #code-sync
- #podcasts
- #javascript
- #onsite
- #dialyzer
- #docker
- #authentication
- #umbrella
- #full-time-contract
- #podcasts-by-brainlid
- #ecto-query
- #elixirconf-us
- #ai
- #blog-post
- #elixir-ls
- #phoenix_html
- #iex
- #graphql
- #genstage
- #websockets
- #supervisor
- #advent-of-code
- #distillery
- #processes
- #api
- #forms
- #hex
- #security
- #metaprogramming
Our Sponsors
Build Elixir applications with speed and confidence.
We build reliable cloud platforms for business-critical systems.
Catch errors, track performance, monitor hosts and more.
Error tracking, logs, uptime, and Just Enough APM. Built for developers.
Elixir, Erlang & BEAM conferences from Code Sync - join us in 2026!
Practical resources that improve the lives of professional developers.
Master modern tools, write cleaner code, and tackle real-world challenges.
Producing high quality Elixir screencasts since 2017.
The team behind Membrane, Popcorn, LiveDebugger. Available for hire.
Courses that'll move you from confusion to "Aha, now I get it!"
Showing Posts 1 to 10- Show Best Posts
- Show All (oldest first)
- Show All (newest first)
dimitarvp
You are a treasure, man. Thank you!
benwilson512
@AstonJ might be worth pinning?
AstonJ
…done
voltone
Mint v1.4.0 was released, with a fix to ensure it connects successfully even on affected OTP versions.
chrismccord
@voltone I just want to say thank you for your stellar contributions around TLS in all the various ways you’ve helped the community over the years, including
phx.gen.cert, blogs, and answering questions. This kind of stuff is incredibly valuable to everyone. Thank you!kenny-evitt
@voltone Thanks!
Based on the posts, these libraries should work as-is, i.e. with no upgrades needed:
This one needs to be upgraded itself, but not Elixir/Erlang/OTP too
I can’t think of any other libraries off the top of my head.
voltone
True, as long as you rely entirely on Hackney’s default
ssloptions. If you pass in anyssloptions of your own (e.g. to disable TLS 1.0 and 1.1, to send a client certificate, to change thesslmodule’s log level) there is a good chance you will be affected. That is, if your customssloptions do indeed verify the server’s certificate and you didn’t accidentally revert back tossl’s default ofverify: :verify_none.There’s a few other HTTP clients that make
ssloptions the responsibility of the user, includinghttpcand Gun. Here again it all depends on what options you pass in.And that’s just HTTP clients. You have to consider other TLS clients as well:
And some people may have built some network protocol client of their own using
ssldirectly.So unless you are absolutely sure that your application only ever uses Hackney with its
ssldefaults, I would still recommend you upgrade your OTP version if at all possible.kenny-evitt
Thanks!
yukster
Anyone know if there are alpine docker images in the works that will use Erlang 23.3.4.5? I’m not seeing anything on docker hub: elixir - Official Image | Docker Hub
neilberkman