LetsEncrypt Certificate not trusted by Spohos XG Firewall

Same problem. I even tried uploading the ISRG Root X1 certificate in the CA tab. The certificates however remain untrusted. Any ideas?

BR
Chris

This should be fixed by a hotfix. See: https://support.sophos.com/support/s/article/KB-000042993?language=en_US

Thanks LuCar Toni,

I've raised a support case. I don't think I've done a backup/restore in the past six months. I've done the relevant firmware upgrades though.

Negative, no backup and restore procedures at all. The firewall is running for almost a year now and I was just applying new firmware when offered.

Can you link me your Case ID? 

I don't know how to find it? I ddn't get a confirmation email and can't see a way to find it from the Support home page. I'm just a home user, so I'm not sure if that changes things.

Home users are not able to created tickets. We need just one ticket, so i can forward this. 

Can you please verify, you have this CA (chain)? 

letsencrypt.org/.../

Yeah, that's my imported CA. The problem still persist though, certificate not trusted. Any ideas?

Can you show us the CA, you uploaded? 

Here is my CA:

Here is my CRT:

I just noticed, that I don't have the problem on my second firewall. Here are the screenshots:

Interesting. The problem disappears when restoring the firewall from backup.
The problem also does not occur when installing the firewall from scratch and updating to the latest SFOS.
I also tried the workarounds in other related threads at this forum, no luck. Is there really no fix for this?

Interesting. The problem disappears when restoring the firewall from backup.
The problem also does not occur when installing the firewall from scratch and updating to the latest SFOS.
I also tried the workarounds in other related threads at this forum, no luck. Is there really no fix for this?

I can report the same. I backed up and restored my firewall config with no other changes, then uploaded the certs and it worked.

It's not a Let's Encrypt problem, it rather looks like a general problem with the firewall's CA. Who is able to reproduce this and could open a ticket (with a subscription)?