TLS connection failure to our endpoint after certificate change

Fatturazione Elettronica
1

I’m writing on behalf of our client.

Since the recent server certificate renewal on our side, the SdI client (source IP 217.175.55.18) fails to establish a TLS connection to our endpoint. Our gateway logs show the TLS handshake proceeding normally (TLS 1.2 negotiated, compatible cipher suites available) until the server certificate is presented, at which point your client aborts the handshake with TLS fatal alert 42 (bad_certificate). This means that the SdI client is actively rejecting the new server certificate. No HTTP request ever reaches the application layer.

The server certificate was renewed and now has the following properties:

  • Subject: CN=xxx

  • Issuer: Sectigo Public Server Authentication CA DV R36 (C=GB, O=Sectigo Limited)

  • Valid: May 4, 2026 – November 18, 2026

  • SHA-1 fingerprint: xxx

  • Key: RSA 2048, sha256WithRSAEncryption

All other clients connect without issues, which indicates the problem seems to be related to the SdI TLS client configuration.

Any hints are really appreciated. We tried to get in touch with the SdI but not really successful yet.

Best regards
Gerald

2

I think you’re confusing the SdI server certificate with your own.
The one you’ve show here looks like the server certificate used by servizi.fatturapa.it, which is signed by Sectigo.
The server certificate you put on your server is the one generated from the CSR you uploaded and is signed by “CA Agenzia delle Entrate”.

3

We can now see that connection attempts are also being made to our production channels. This had not been the case since the certificate renewal.

However, these connection attempts are now also failing with the error message “Fatal Alert 42”

For clarity, we would like to summarize the most important facts:

The channels have been operating successfully and without any issues for more than two years.
The connection is always established using TLS 1.2.
The certificate renewal performed in May 2025 was completed successfully and did not require any changes on our side.
During this year’s certificate renewal, Sectigo retired the former root certificate “Sectigo AAA”. The renewed certificate is now based on the new root certificate “Sectigo Public Server Authentication Root R46” and the intermediate certificate “Sectigo Public Server Authentication CA DV R36”.
We would also like to point out that your service at https://sdi.fatturapa.gov.it/ uses the same certificate chain that we use for our endpoints:

https://webservices.xxx.de/TrasmissioneFatture

https://webservices.xxx.de/RicezioneFatture

Furthermore, the log excerpt included in SdI’s response appears to confirm that the TLS handshake currently fails during certificate validation on the client side. In particular, the following error was reported by your system:

“TLS library error: error: routines:tls_process_server_certificate:certificate verify failed”

This message indicates that the server certificate presented by our endpoint could not be validated against the trust store available to the connecting client. Since the TLS handshake terminates at this stage, no application-level communication can take place.

Therefore, we suspect the following root cause:

The previous SSL certificate, valid until 02/06/2026, was issued under the root certificate:

Sectigo AAA

Sectigo has retired this certificate and explicitly stated that renewed certificates can no longer be validated solely against Sectigo AAA. Validation must now be performed using the new root certificate:

Sectigo Public Server Authentication Root R46

Given the “certificate verify failed” error reported by SdI’s system, this appears to be consistent with a missing or outdated trust anchor in the trust store used by the connecting TLS client (SdI).

4

I still think you are confusing certificates!
First of all, your client and server certificates should be valid for 3 years (we last renewed them in 2024 and they are valid until 2027).
Second, as I said before, they should be issued by “CA Agenzia delle Entrate”, not Sectigo.
Our certificate has:
Issuer: C = IT, O = Agenzia delle Entrate, CN = CA Agenzia delle Entrate

Double check the Subject of the certificate issued by Sectigo you are talking about. Does the CN contain your server’s FQDN or your VAT number?
If it looks like this: Subject: C = IT, ST = Lazio, O = SOGEI, CN = servizi.fatturapa.it, then you’re looking at SDIs server certificate, not yours.

If they actually issued you a server certificate signed by Sectigo, then it must be a recent change I don’t know about. If it doesn’t work, you should contact SDI support.