Hello,

	csharp -e 'new System.Net.WebClient ().DownloadString ("https://letsencrypt.org/")'

currently fails with a TrustFailure. The certificate that (currently) is
served there looks as follows:

Certificate chain
 0 s:CN = lencr.org
   i:C = US, O = Let's Encrypt, CN = R3
 1 s:C = US, O = Let's Encrypt, CN = R3
   i:C = US, O = Internet Security Research Group, CN = ISRG Root X1
 2 s:C = US, O = Internet Security Research Group, CN = ISRG Root X1
   i:O = Digital Signature Trust Co., CN = DST Root CA X3

(taken from

	openssl s_client -connect letsencrypt.org:https

). For a similar setup webserver connecting using the above commandline
succeeds when the "DST Root CA X3" certificate is taken out of the
provided chain.

I guess the ssl verifying component in mono has the same problem as
openssl < 1.1.0, i.e. the expired "DST Root CA X3" certificate makes the
verification fail even though the "ISRG Root X1" is trusted.

This breaks keepass2 when it's setup to have the password-db on a
https-secured webdav store.

Similar bug reports can be found on the net, e.g.:

https://sourceforge.net/p/keepass/discussion/329221/thread/21747e1096/

(I don't really know about mono and so probably picked the wrong Package
to report this problem against, please reassign accordingly.)

Best regards
Uwe