Announcements Status

DST Root CA X3 Expired

For more information from Let’s Encrypt visit:

Since September 30th we have received reports from two of our mail services customers that they were no longer able to send/receive mail with their Exchange servers due to a certificate expiration error. Our certificates have not expired; a root certificate (DST Root CA X3) has expired. The Let’s Encrypt R3 is signed by DST Root CA X3 (now expired) and ISRG Root X1 (trusted). The latter, ISRG Root X1, is what should be used.

Since June 2017 Roller Network has been using Let’s Encrypt. Our certificates update continuously: the certificates we have are only valid for 90 days, then are automatically replaced with a new one when they reach less than 30 days until expiration. It’s not possible for us to have “old” certificates since the oldest one will only ever be 2 months old before it gets replaced with a new one (and we monitor every Let’s Encrypt deployed service for freshness with alerts if a cert goes under 28 days). This process happens continuously on every system we have that uses SSL/TLS.

All certificates ultimately rely on a chain of trust based on a root store of trusted certificates present in every platform that the chain of validation is based on. All of these also have an expiration date, but a longer one since changing these either requires an OS update (usually in the form of security updates) or for platforms that no longer receive updates, manually installing new root certificates if it doesn’t have ISRG Root X1 installed. Alternatively, some platforms allow manually setting trust for an expired root certificate or need to remove an old root certificate.

The only reports we have received with TLS problems is with Exchange. Unfortunately we don’t have anyone on staff with Exchange experience, so we don’t have a fix to give out. At this point we can only recommend reading what others have done to address issues with cross-signed certificate authorities, although if we find a procedure specific for Exchange we’ll pass it along. For platforms based on OpenSSL 1.0.x this is a known bug which is fixed by updating to OpenSSL 1.1.x.

The reason the old, expired root is still in the chain is for an Android compatibility thing as detailed here:

To view certificates in Windows see:

On Windows the expired “DST Root CA X3” should be under Trusted Root Certification Authorities and Third Party Root Certificates. Removing it and rebooting may help (or it may not, we don’t have a way to test an Exchange server).

For a complete list of platforms compatible with Let’s Encrypt see:

Announcements TahoeIX

DNS over HTTPS and TLS

We’ve recently enabled DNS over HTTPS (DoH) and DNS over TLS on our resolvers for our customers (IPv4 and IPv6).

For DNS over HTTPS (DoH) use:

For DNS over TLS use:


Our DNS servers validate DNSSEC (queries will be answered with SERVFAIL in case of bogus data). If you have trouble resolving DNS that appears to work with sites that are not DNSSEC-aware, check it with the DNSViz tool:

Our DNS servers will only respond to queries from our network (users on Roller Network IP addresses). If you are a peer or downstream customer with your own address space, please contact us to add your IP addresses to our “allow” list. For public service we recommend Quad9. Quad9 is globally anycasted including a local peer in Reno, NV at TahoeIX. For more information visit:


New Site

New website. Same content. Less pictures (for now but we’ll work on that, maybe). We have redirects for all the old URIs we know of, but let us know if something is broken.

Announcements Changes

Peering at SFMIX

Now peering at SFMIX in the San Francisco “Silicon Valley” region of California. Roller Network has an open peering policy and we are happy to peer with networks of any size. We’re also on the route servers.

Announcements Changes Status

SquirrelMail End of Life Notice

Since the very beginning of our hosted mail service, SquirrelMail was there as a webmail option. It’s served thousands of users well, but the time has come where we need to declare SquirrelMail end of life (EOL) and no longer supported. SquirrelMail has not been actively developed for several years, and incompatibility with other upgrades we will be making across our system is very likely.

As an EOL service, we will no longer test changes for compatibility with SquirrelMail. Although the basic email functions of SquirrelMail will continue to function, any broken additional features in SquirrelMail will be removed or disabled.

We understand the desire for a simple webmail interface still exists in our customer base and we will be looking at replacement options. In the meantime, please plan to migrate your webmail needs to RoundCube at:

SquirrelMail will be shut down on December 31, 2020.