Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I'm using NordVPN and it's popped up with this about how it couldn't validate a TLS certificate:
I've tried looking up what ISRG is but I don't get much of an explanation on it anywhere. It appears both at my home and work wifi connections, and I have no idea where it comes from. Is this a bad thing? If so, how do I fix it? Am I even in the right place for asking this question?
ISRG is the entity who runs LetsEncrypt and "ISRG Root X2" is the LetsEncrypt CA that anchors ECC certs. But ISRG X2 is fairly recently created and not yet widely trusted -- it apparently is not in the truststore of whatever you are running -- and as that diagram shows servers are supposed to not use X2's own root cert but instead a 'bridge' cert for X2 cross-signed by X1 which IS now widely trusted. It looks like some server run by NordVPN is either configured to use the wrong cert chain, or (more likely) is using an automated process (i.e. ACME) but their ACME client is getting and using the wrong cert chain.
You should probably check with NordVPN's customer service, because they know most about how both their client software and their servers work, but there are likely other users of that product here (not me) who might be able to help if you specify what you are doing (and running) clearly enough to figure out what server(s?) is(are) involved. Set community-wiki in case any such person comes along.
