Sophos XG - Lets Encrypt broken - Certificate authority: Invalid or not installed

We are facing on all devices the same issue since all created certificates after 1. October !Finally the solution was on our tool win-acme to choose Elliptic Curve key instead of RSA ! After importing the pfx certificate - all untrusted certificates get green ! I am still not able to generate any RSA key based cert on Lets encrypt which will work in Sophos XG or XGS ! I hope that will help someone also ! 

Funny is that the chain of CA is the same !

We are facing on all devices the same issue since all created certificates after 1. October !Finally the solution was on our tool win-acme to choose Elliptic Curve key instead of RSA ! After importing the pfx certificate - all untrusted certificates get green ! I am still not able to generate any RSA key based cert on Lets encrypt which will work in Sophos XG or XGS ! I hope that will help someone also ! 

Funny is that the chain of CA is the same !

Hi I have same issue certifciate is not trusted in sophos but SSLABS check is ok, webserver certificate is bounded but i'm unable to add certificate to admin iterface but other thing are working. Weird

I could solve it by SSH-->Advanced shell, check all certificates in folder /conf/certificate/cacerts. 

In my situation this folder contained a lot of imported ca certificates that didn't show in the web interface (including the expired DST certificate, but it had the name of my website+CA). After deleting all the uploaded certificates in this folder, and after deleting/reimporting the  letsencrypt certificates in the webinterface, they are green and trusted again.

that sounds to me like the best workaround here. Thanks for sharing.

Hi i have chceck my apliance but problem still persist, on advanced console I didnt see old DST certificate in /conf/certificate/cacerts it was removed with gui probably but  it must be somewhere else:) , sslabs check still see old chain with DST root, what I have missed?

Hi JZ, I think you have to look closely in the /conf/certificate/cacerts, but it must be there somewhere, maybe under a "strange" name, perhaps also look at file dates (ls -l). The name of the DST certificate can take many shapes or forms if you imported a pfx containing the complete chain in the past.

how do you view the files in that directory i get permission denind when i try