SSL cert for https://download.dnscrypt.info has expired

[tolvos]

Howdy!

I use dnscrypt-proxy in an OCI container (https://github.com/klutchell/dnscrypt-proxy-docker), and am noticing this issue when trying to start:

sudo incus start dnscrypt --console
Password: 
To detach from the console, press: <ctrl>+a q
[2026-08-27 05:01:54] [NOTICE] Network connectivity detected
[2026-08-27 05:01:54] [NOTICE] Now listening to 0.0.0.0:53 [UDP]
[2026-08-27 05:01:54] [NOTICE] Now listening to 0.0.0.0:53 [TCP]
[2026-08-27 05:01:54] [CRITICAL] Unable to retrieve source [public-resolvers]: [Get "https://download.dnscrypt.info/resolvers-list/v2/public-resolvers.md": tls: failed to verify certificate: x509: certificate has expired or is not yet valid: current time 2026-08-27T05:01:54Z is after 2026-08-27T03:04:08Z]
[2026-08-27 05:01:54] [FATAL] Get "https://download.dnscrypt.info/resolvers-list/v2/public-resolvers.md": tls: failed to verify certificate: x509: certificate has expired or is not yet valid: current time 2026-08-27T05:01:54Z is after 2026-08-27T03:04:08Z

Since the problem seems to stem from https://download.dnscrypt.info's SSL cert, I don't think this is a problem with the OCI container. Here's some curl results:

curl -Iv https://download.dnscrypt.info
* Host download.dnscrypt.info:443 was resolved.
* IPv6: (none)
* IPv4: 143.244.60.195
*   Trying 143.244.60.195:443...
* ALPN: curl offers h2,http/1.1
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* SSL Trust Anchors:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
*   CApath: /etc/ssl/certs
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / RSASSA-PSS
* ALPN: server accepted h2
* Server certificate:
*   subject: CN=download.dnscrypt.info
*   start date: May 29 03:04:09 2026 GMT
*   expire date: Aug 27 03:04:08 2026 GMT
*   issuer: C=US; O=Let's Encrypt; CN=YR2
*   Certificate level 0: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption
*   Certificate level 1: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption
*   Certificate level 2: Public key type RSA (4096/152 Bits/secBits), signed using sha256WithRSAEncryption
*   Certificate level 3: Public key type RSA (4096/152 Bits/secBits), signed using sha256WithRSAEncryption
*   subjectAltName: "download.dnscrypt.info" matches cert's "download.dnscrypt.info"
* OpenSSL verify result: a
* SSL certificate OpenSSL verify result: certificate has expired (10)
* closing connection #0
curl: (60) SSL certificate OpenSSL verify result: certificate has expired (10)
More details here: https://curl.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the webpage mentioned above.

From what I can tell, folks who are trying to set up dnscrypt-proxy for the first time are probably going to hit this error and not be able to do anything. Actively running instances of dnscrypt-proxy are probably fine (for now?)

[welwood08]

FWIW, I also see an expired certificate from my location but the Qualys SSL Server Test I ran sees a valid chain expiring next month. It appears the site is running behind BunnyCDN and one of the features they offer is "free auto-renewing SSL certificates via Let’s Encrypt", so I assume this is a problem on their end where some of their front-end servers have fallen out of sync.

Regarding new and existing users, the default configuration specifies 3 diverse domains for sources so even if this one is unreachable the other 2 (GitHub and jsDelivr) should allow startup to proceed (verified locally with fresh copy of 2.1.18).

[tolvos]

Huh, good catch! Perhaps the complete failure to launch is a quirk of the OCI build I'm using, it is using 2.1.18 as well but fails completely from the first server, doesn't attempt the other domains. Perhaps an issue for the maintainer of that project instead.

(or I'm just a weirdo for using incus, wouldn't be the first time :\ )

[jedisct1]

Looks like an automatic renewal issue at BunnyCDN, indeed.

I've temporarily moved the hostname to another CDN while this is being sorted out.