我知道已经有很多答案了。对于那些使用专用网络(如Zscaler等)的用户来说，如果需要更新rootcert，则可能会出现此错误。如果在Windows机器上使用WSL，这里有一个关于如何实现此更新的解决方案:

#!/usr/bin/bash

# I exported the Zscaler certifcate out of Microsoft Cert Manager.  It was located under 'Trusted Root Certification > Certificates' as zscaler_cert.cer.
# Though the extension is '.cer' it really is a DER formatted file.
# I then copied that file into Ubuntu running in WSL.

# Convert DER encoded file to CRT.
openssl x509 -inform DER -in zscaler_cert.cer -out zscaler_cert.crt

# Move the CRT file to /usr/local/share/ca-certificates
sudo mv zscaler_cert.crt /usr/local/share/ca-certificates

# Inform Ubuntu of new cert.
sudo update-ca-certificates 

这可能听起来微不足道;然而，修正我的约会日期，问题就解决了。检查你的日期和时间是否正确。

我做了什么来解决这个问题在终端(Ubuntu 18.04):

openssl s_client -showcerts -servername www.github.com -connect www.github.com:443

我得到了两个证书块。我将证书块复制到我的证书文件/etc/ssl/certs/ca-certificates.crt。

也有同样的问题。由自己颁发的证书颁发机构引起。 通过在/usr/local/share/ca-certificates/中添加.pem文件解决 和调用

sudo update-ca-certificates

PS:“/share/ca-certificates”文件夹下的pem文件必须有扩展名。crt

Linux/Debian使用:

sudo cp /etc/ca-certificates.conf /etc/ca-certificates.conf.orig
sudo nano /etc/ca-certificates.conf
Change “mozilla/DST_Root_CA_X3.crt” in “!mozilla/DST_Root_CA_X3.crt” an save
sudo update-ca-certificates

https://talk.plesk.com/threads/lets-encrypt-root-certificate-expiration-on-30-september-2021.362224/

最后更新:2021年9月30日|参见所有文档

一个平台是否能够验证Let’s Encrypt证书的主要决定因素是该平台是否信任ISRG的“ISRG Root X1”证书。在2021年9月之前，一些平台可以验证我们的证书，即使他们不包括ISRG根X1，因为他们信任IdenTrust的“DST根CA X3”证书。从2021年10月起，只有那些信任ISRG Root X1的平台才会验证Let’s Encrypt证书(Android除外)。

当前系统

如果你的系统是最新的，但由于某种原因自动更新不起作用，应该有足够的:

apt update
apt upgrade
sudo dpkg-reconfigure ca-certificates

在reconfigure阶段，取消选择“DST根CA X3”证书

过时的系统

要解决，在旧的Linux服务器上，如Ubuntu 16或Debian 8 jessie，需要几个步骤:

upgrade openssl to anything >=1.0.2 On Debian jessie enable backports source, add this line to sources.list: deb http://archive.debian.org/debian jessie-backports main contrib non-free and do apt-get install -t jessie-backports openssl ensure security updates for ca-certificates package apt upgrade download latest LetsEncrypt root CA certs: sudo curl -k https://letsencrypt.org/certs/isrgrootx1.pem.txt -o /usr/local/share/ca-certificates/isrgrootx1.crt sudo curl -k https://letsencrypt.org/certs/letsencryptauthorityx1.pem.txt -o /usr/local/share/ca-certificates/letsencryptauthorityx1.crt sudo curl -k https://letsencrypt.org/certs/letsencryptauthorityx2.pem.txt -o /usr/local/share/ca-certificates/letsencryptauthorityx2.crt sudo curl -k https://letsencrypt.org/certs/lets-encrypt-x1-cross-signed.pem.txt -o /usr/local/share/ca-certificates/letsencryptx1.crt sudo curl -k https://letsencrypt.org/certs/lets-encrypt-x2-cross-signed.pem.txt -o /usr/local/share/ca-certificates/letsencryptx2.crt sudo curl -k https://letsencrypt.org/certs/lets-encrypt-x3-cross-signed.pem.txt -o /usr/local/share/ca-certificates/letsencryptx3.crt sudo curl -k https://letsencrypt.org/certs/lets-encrypt-x4-cross-signed.pem.txt -o /usr/local/share/ca-certificates/letsencryptx4.crt sudo dpkg-reconfigure ca-certificates during reconfigure stage, please deselect "DST Root CA X3" certificate

在这些步骤之后，apt update应该适用于基于LetsEncrypt的源代码，wget和curl应该不会抱怨。

特别注意curl -k允许连接“不安全”的SSL服务器，因为LetsEncrypt证书不受信任。