Mongodb SSL connection failing when using SSL certificate issued by Let's encrypt suddenly even though the certificate is not expired

Question

I am using Nginx as a reverse proxy server for MongoDB (deployed in docker) using TCP Streams. Using Nginx also helps me to easily configure SSL certificates obtained from Let's encrypt. Everything is working fine but suddenly I started seeing certificate validation issues across multiple apps when nothing is changed. All my python apps failed by throwing CERTIFICATE_VERIFY_FAILED errors. I can't even connect to the database using the Mongo compass tool via SSL at the same time. MongoDB compass showing as certificate expired. But, I am sure that the certificate is still not expired. I am using the requests 2.3.0 library in python and when I upgrade the requests library the python apps are working but still, the Mongo compass is not connecting. Note that my python apps get/post data to other APIs which are again behind Nginx using SSL certificate issued by Let's encrypt. In python the error occurred whenever it tries to validate the SSL either for db connection or for interesting with other API.

Has any one faced this issue? Can you give any suggestions on the root causes for these errors?

Urology

People all over the world have faced this issue, caused by the expiration on Sept. 30 of the older 'DST' root cert used by LetsEncrypt; see letsencrypt.org/docs/dst-root-ca-x3-expiration-september-2021 . Python is affected if it uses OpenSSL below 1.1.0; see openssl.org/blog/blog/2021/09/13/LetsEncryptRootCertExpire although changing requests shouldn't affect this, unless you alter the 'verify' option to exclude DST root and include ISRG. Many Qs have already been posted, although the only Python I've seen is https://mcmap.net/q/913031/-odoo-xmlrpc-certification-has-expired (not answered). – Tedi

In this case you control the server(s?) so you can install the ISRG-only chain (i.e. remove the ISRG-to-DST bridge) and all clients, unless ancient, should be happy. If you're using certbot try --preferred-chain, see #69398345 and #69396323 – Tedi