yea. Ended up being my RHEL8 boxes didn't blacklist the LE cert like Centos7 did. Strange, but fixed (I think).

Did you check /etc/haproxy/certs for the expired certs?

I have a mix of old Centos7 and RHEL8 machines. Recently I noticed the (edit: expired) DST X3 cert is still in the ca-bundle.crt link but not on the Centos7 machines.

both are running the up to date ca-certificates package.

[https://access.redhat.com/articles/6338021](https://access.redhat.com/articles/6338021)

I see that article, but I'm not finding any info anywhere on how to remove the old certificate and I have applications (namely HAPROXY) still trying to use the DST X3 expired cert.

LE DST X3 Cert removal