I hadn't used Emacs for a few weeks and when I started it up I discovered issues with certificate information for elpa, melpa and orgmode. When I launch Emacs I get the following message:

The TLS connection to elpa.gnu.org:433 is insecure for the following reasons:

  • certificate has expired
  • certificate could not be verified

When I look at the details the certificate issuer is Let's Encrypt. I read that the root certificate for Let's Encrypt expired in September and I wonder if that's the issue? This problem wasn't happening the last time I started up Emacs at the beginning of September.

The trouble is, I don't know how to circumvent this. I've installed OpenSSL and tried to point gnutls-trustfiles to the certificate file in that to see if it helps but that hasn't changed anything. I'm on Windows (Emacs 27.2) and it's difficult to find resources on this.


This may help.

  • If on Windows, change package-gnupghome-dir to use /c/ instead of c:/
  • Run gpg to get the new public key (if on Windows, in MingW64 shell)

$ gpg --homedir /c/Users/micha/AppData/Roaming/.emacs.d/elpa/gnupg --receive-keys 066DAFCB81E42C40

gpg: /c/Users/micha/AppData/Roaming/.emacs.d/elpa/gnupg/trustdb.gpg: trustdb created

gpg: key 066DAFCB81E42C40: public key "GNU ELPA Signing Agent (2019) <elpasign@elpa.gnu.org>" imported

gpg: Total number processed: 1
gpg:               imported: 1

Note: you may have to delete the gnupg directory to get gpg to pull the key again.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.