Let's Encrypt broken - Certificate authority

Hi .. 

Just wanted to list the steps I performed to finally validate LE Cert on XG 19.0.1 MR-1-Build365.  I spent over a month trying to narrow down the issue and I might have read every article in this forum with no avail.  I hope this helps.

The steps below direct you to deleted certs from my XG FW, so use these steps at your own risk, and perform proper backup before making any changes.

1.  When generating a LE Cert with certbot - make sure your certificate uses --preferred-chain "ISRG Root X1"
   
   1. This only works with the latest version of certbot so make sure you get that version installed/updated
   2. When you examine your cert (I'm using KeyStore Explorer below), make sure the ROOT cert is self signed and is NOT using DST Root CA
   3. 
2. Install this cert onto your XG, if the cert is still invalid, the issue might be related to the list of broken/old CAs installed on your FW, some of which are visible in GUI and most are not.
3. Use Putty to SSH to your XG  -  AGAIN Proceed at your own risk as these steps delete certs - make sure to properly backup your FW.
   1. Change Dir to /conf/certificate/cacerts
      
   2. run ls -l
   3. This command will list all the certs in this directory that you might have uploaded in the past, some of which have obscure names
   4. 
   5. Copy and paste this in a text file and search for ISRG, R3, LE and remove them if they are related to Lets Encrypt certs.  
   6. You can use openssl to review and use "sudo rm <filename>" to delete
4. After you remove all broken/old certs, you will now need to download and install the latest CA Certs used to sign your certs.   Mine used the below CA certs. 
   1. Go to https://letsencrypt.org/certificates/
   2. Download ISRG Root X1 pem file
   3. Download R3 pem file
5. Add them to XG FW - do not modify the name of the cert when adding.
6. 

Hope this helps.