# Error in updater - Trust Failure - SSL error

**URL:** https://forum.duplicati.com/t/error-in-updater-trust-failure-ssl-error/13548
**Category:** Support
**Created:** [December 10, 2021, 6:07pm UTC](https://forum.duplicati.com/t/error-in-updater-trust-failure-ssl-error/13548 "2021-12-10T18:07:24Z")
**Posts on this page:** 1
**Showing post:** 4

<div class="post-metadata">

### Author: ![ts678](https://forum.duplicati.com/letter_avatar_proxy/v4/letter/t/8491ac/32.png) [@ts678](https://forum.duplicati.com/u/ts678)
#### Post date: [December 16, 2021, 12:50pm UTC](https://forum.duplicati.com/t/error-in-updater-trust-failure-ssl-error/13548/4 "2021-12-16T12:50:21Z")

</div>

> [@mango1402](#):
>
> email notofication using STARTTLS dont’t work too. Maybe same problem?

Seems likely, however you would need to run the [SSLLABS tester](https://www.ssllabs.com/ssltest/) or openssl s\_client to say for sure.

> [@seanws78](#):
>
> This is the error from running the backup job

The Updater and Backblaze problems are probably from same expired Let’s Encrypt certificate issue:

[DST Root CA X3 Expiration (September 2021)](https://letsencrypt.org/docs/dst-root-ca-x3-expiration-september-2021/)

however Backblaze now uses a certificate Valid from Tue, 30 Nov 2021 02:22:14 UTC which might be  
causing recent problems. [updates.duplicati.com](http://updates.duplicati.com) has I think been using Let’s Encrypt certificate awhile.

So when your failure began is an indirect way of knowing which change affected you. A direct check is

[A System.Net.WebException: Error: TrustFailure error occurs](https://forum.duplicati.com/t/a-system-net-webexception-error-trustfailure-error-occurs/13389/25)

and is somewhat experimental, but runs the mono certmgr tool to find out exactly what mono is using.

> [@obones](#):
>
> `O=Digital Signature Trust Co., CN=DST Root CA X3`

is what you don’t want, but the exact way of removing it depends on your OS. I have little idea what an ASUSSTOR NAS has inside. Some such systems run Debian, and there’s pretty good info on its use.

If your system is up-to-date, it might already have the required `ISRG Root X1`, but it’s worth checking.

[Extending Android Device Compatibility for Let’s Encrypt Certificates](https://forum.duplicati.com/t/http-send-report-errors-duplicati-monitoring/13157) broke mono and older OpenSSL.

[OpenSSL Client Compatibility Changes for Let’s Encrypt Certificates](https://community.letsencrypt.org/t/openssl-client-compatibility-changes-for-let-s-encrypt-certificates/143816)

One Debian certificate deletion change that has worked for many people is referenced from this post:

[TrustFailure error when using Backblaze B2](https://forum.duplicati.com/t/trustfailure-error-when-using-backblaze-b2/13488/8)

Unfortunately the exact procedure is OS-dependent, but the intent is the same. Need to fix certificates.

---

_[View the full topic](https://forum.duplicati.com/t/error-in-updater-trust-failure-ssl-error/13548)._