A fun thing happened to me this morning, mails to “outlook” provider domains started temp failing with “UnknownIssuer” TLS errors:
: invalid peer certificate: UnknownIssuer, TLS handshake with ResolvedAddress { name: \"outlook-com.olc.protection.outlook.com.\", addr: 52.101.73.10 }
It seems that on my Ubuntu 24.04 box, the Digicert global root that Outlook is using doesn’t exist.
openssl s_client -connect 52.101.73.10:25 -starttls smtp -servername outlook-com.olc.protection.outlook.com
CONNECTED(00000003)
depth=1 C = US, O = DigiCert Inc, CN = DigiCert Cloud Services CA-1
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, CN = mail.protection.outlook.com
verify return:1
---
Certificate chain
0 s:C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, CN = mail.protection.outlook.com
i:C = US, O = DigiCert Inc, CN = DigiCert Cloud Services CA-1
a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256
v:NotBefore: Aug 27 00:00:00 2025 GMT; NotAfter: Aug 26 23:59:59 2026 GMT
1 s:C = US, O = DigiCert Inc, CN = DigiCert Cloud Services CA-1
i:C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Global Root CA
a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256
v:NotBefore: Sep 25 00:00:00 2020 GMT; NotAfter: Sep 24 23:59:59 2030 GMT
---
I’m not sure yet if Outlook have changed roots, or the Ubuntu ca-certificates package have removed Digicert,
Yes, the Digicert G1 root was removed from the ca-certificates package, seems I missed the news on that happening:
https://certera.com/blog/digicert-g1-root-removal-2026-what-it-means-what-actions-to-do/
Anyway a quick fix if anyone else needs it is:
# Get DER cert
curl -o /usr/local/share/ca-certificates/digicert-global-root-ca.crt https://cacerts.digicert.com/DigiCertGlobalRootCA.crt
# Transform to PEM
openssl x509 -inform DER -in /usr/local/share/ca-certificates/digicert-global-root-ca.crt -out /usr/local/share/ca-certificates/digicert-global-root-ca.crt -outform PEM
# Update cert list
update-ca-certificates
And a Kumo service restart got things back up and running.