Recently, I also encountered an issue with the DoH (DNS over HTTPS) server connection error on my hAP AC3, specifically using the Cloudflare DNS service (1.1.1.1). After some investigation, I discovered a temporary fix that involves replacing the deprecated DigiCertGlobalRootCA.crt.pem certificate with the DigiCertGlobalRootG2.crt.pem certificate.
However, I’m concerned that this may only be a short-term solution. Cloudflare has alerted users that DigiCert will soon be removed as a CA from their pipeline.
To address this, I’m reaching out to the community for assistance. Are there alternative and more permanent solutions that you can recommend?
For reference, the temporary fix involves replacing the certificate using the following link: https://cacerts.digicert.com/DigiCertGlobalRootG2.crt.pem
My settings:
> /ip/dns/print
servers:
dynamic-servers:
use-doh-server: https://1.1.1.1/dns-query
verify-doh-cert: yes
doh-max-server-connections: 5
doh-max-concurrent-queries: 50
doh-timeout: 5s
allow-remote-requests: yes
max-udp-packet-size: 4096
query-server-timeout: 2s
query-total-timeout: 10s
max-concurrent-queries: 100
max-concurrent-tcp-sessions: 20
cache-size: 2048KiB
cache-max-ttl: 1w
address-list-extra-time: 0s
cache-used: 104KiB
Commands:
/certificate/print;
/certificate remove [ find ];
/certificate import file-name=DigiCertGlobalRootG2.crt.pem passphrase="";
/certificate/print;
I appreciate any insights or guidance the community can provide. Let’s work together to find a robust and enduring solution.
Thanks in advance.