It should ask you to confirm that you want to add the certificate to the root store.

Rename the file from isrgrootx1.pem to isrgrootx1.crt.

Download (which may involve clicking through warnings, I guess, as you don't currently trust the root).

In terms of specific steps to install the root (though this is from memory so I might be missing a step):

Or, you can try using another CA, but that will just defer the problem until whichever root that CA has in the old trust store also expires. If Firefox still runs on Windows 7, you could try that since it uses its own trust store. The only possible 'fix' is to update to a supported platform. As roots expire, old systems that aren't getting security (including trust store) updates will have less and less access to the Internet. Let's Encrypt may be the most well-known issuer of certificates, but it's really nothing specific to them. The only 'bug' is that Windows 7 is too old to get security updates. The same thing happens if i visit from chrome on windows 7.

How can we fix this? there are many people with Chrome on Windows 7. What I have tried until now is in the server machine to declare both DST Root CA X3 and R3 in the untrusted ones and rebooted the server, but it did not help. Hello, since the old certificates expired, I renewed them yesterday with win-acme and all is fine in Windows 10 with all browsers, but in Windows 7 Chrome (fully updated, version 94.xx) shows NET::ERR_CERT_DATE_INVALID and shows the old expired ones not ISRG. output of certbot -version or certbot-auto -version if you're using Certbot): win-acme.v2.1.11.917.圆4.pluggable I'm using a control panel to manage my site (no, or provide the name and version of the control panel): I can login to a root shell on my machine (yes or no, or I don't know): The operating system my web server runs on is (include version): Windows Server 2012 R2 My web server is (include version): IIS 8.5 crt.sh | ), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. Note: you must provide your domain name to get help. Please fill out the fields below so we can help you better.

Google chrome update windows 7