Hi all, As you may know, the DST Root CA X3 expired some time ago. The debops.pki role used to configure it as the root certificate for all realms that were issued by Let's Encrypt. Let's Encrypt has since switched to their own ISRG Root X1, and the DebOps role has been updated to reflect this. If you have the latest patches from the master or stable branches, new realms will automatically have the new root ca configured. This change will also be in the next DebOps release, which is planned for January 2022. However, re-running the patched debops.pki role against all your hosts will not automatically update the existing realms. You can follow these instructions to update any old references to the DST root in your realms: https://github.com/debops/debops/issues/1860#issuecomment-986784054 If you have any comments about this, please put them in the linked GitHub issue. Thanks, Imre