root@localhost]#update-ca-trust
[root@localhost]#uname -r
5.4.17-200.fc31.x86_64
[root@localhost]#cat /etc/redhat-release
Fedora release 31 (Thirty One)
[root@localhost]#openssl s_client -showcerts -connect www.noudaldenhoven.nl:443
CONNECTED(00000003)
depth=0 CN = noudaldenhoven.nl
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 CN = noudaldenhoven.nl
verify error:num=21:unable to verify the first certificate
verify return:1
---
Certificate chain
 0 s:CN = noudaldenhoven.nl
   i:C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3
-----BEGIN CERTIFICATE-----
MIIFbzCCBFegAwIBAgISAx64o5+bc+YETmKyCZbIkE54MA0GCSqGSIb3DQEBCwUA
MEoxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MSMwIQYDVQQD
ExpMZXQncyBFbmNyeXB0IEF1dGhvcml0eSBYMzAeFw0yMDAxMzEyMjAwMzdaFw0y
MDA0MzAyMjAwMzdaMBwxGjAYBgNVBAMTEW5vdWRhbGRlbmhvdmVuLm5sMIIBIjAN
BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArJ0HTWgJP7M599LcpPapT4/plER+
/KUrH+rT6N3pqjlk0u6KSF/rNpNKnbf+9TlCNEDEIfVAU52bjejO75SSxgKdYMPn
BB5Zt9764QfnPYWQquNgK3DnHgQ2w3wOJ0Kr62fiMyHTYRQMV3Mfb3wMwQjUmFD3
VwnE/Ao46oM+czL7+vZVs2V3d+dQX4GezHE2OmzqWHos9WTKLvMZm6dWZTl1Hagi
FPMVccqXx+x1qjjozvkb8pmuyZKdSMP3zVNvQrA7h+jklsgJw85Kje/WmJzD/+oI
2/TOhqP13p3MOKNbg5NyHDgSXk+3dcDiPDbCstfa3YX871ujXbmo1lOt7wIDAQAB
o4ICezCCAncwDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggr
BgEFBQcDAjAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBTNRLQZ+R5zOTkxldCb8fNG
jirlQDAfBgNVHSMEGDAWgBSoSmpjBH3duubRObemRWXv86jsoTBvBggrBgEFBQcB
AQRjMGEwLgYIKwYBBQUHMAGGImh0dHA6Ly9vY3NwLmludC14My5sZXRzZW5jcnlw
dC5vcmcwLwYIKwYBBQUHMAKGI2h0dHA6Ly9jZXJ0LmludC14My5sZXRzZW5jcnlw
dC5vcmcvMDMGA1UdEQQsMCqCEW5vdWRhbGRlbmhvdmVuLm5sghV3d3cubm91ZGFs
ZGVuaG92ZW4ubmwwTAYDVR0gBEUwQzAIBgZngQwBAgEwNwYLKwYBBAGC3xMBAQEw
KDAmBggrBgEFBQcCARYaaHR0cDovL2Nwcy5sZXRzZW5jcnlwdC5vcmcwggECBgor
BgEEAdZ5AgQCBIHzBIHwAO4AdQCyHgXMi6LNiiBOh2b5K7mKJSBna9r6cOeySVMt
74uQXgAAAW/91bGhAAAEAwBGMEQCIAp2CwSrdKXHcdNPK83hhqbfm49gJ68ZqQM6
wQIPJzuIAiBurecismiBKyHfPUigI9HaGerqHsD0vexVuTewz6V4pgB1AF6nc/nf
VsDntTZIfdBJ4DJ6kZoMhKESEoQYdZaBcUVYAAABb/3Vs6oAAAQDAEYwRAIgV3+N
sHSeUk4wGOaNzxmibQoeqf8IGafwN8ETnu7lDBUCICq7NJSRMREOQxRrW4hDmiTl
dJr4k+C9Y73NXJR6O9xwMA0GCSqGSIb3DQEBCwUAA4IBAQACAW+iS3shVNn8Yc5r
XdwMeaiNF4GjkbUbsQNW1tHjA8NURCxMBYs78DRD/+MFAClkZFZJNUru2mPdMzTB
W2+bo1oLEjFxN7+bunP9xFMaspc3vcVjWoyf+qgeT2KrzoZCVTcG75as5Vma/IDq
jmtqNu+jjt4C2CGN5W/nlSSKAbe8tZF71sLGjvxy5XEnWH2sxWjsmzP71f+2jELp
2qckZEcrAzDszkNSWZoEvefAsSLFuU2IZmYBCRXNz7R9wQPBnG/A3llhqT15lMDK
9mF2UEey4SdPrCZh6tAWRIszaKqEW2fHMkwswDsPO+sIjQ1/G6bSRf00xzoNWcrL
2un8
-----END CERTIFICATE-----
---
Server certificate
subject=CN = noudaldenhoven.nl

issuer=C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3

---
No client certificate CA names sent
Peer signing digest: SHA256
Peer signature type: RSA
Server Temp Key: ECDH, P-256, 256 bits
---
SSL handshake has read 2101 bytes and written 459 bytes
Verification error: unable to verify the first certificate
---
New, TLSv1.2, Cipher is ECDHE-RSA-AES256-GCM-SHA384
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-AES256-GCM-SHA384
    Session-ID: F6144175D19F546945D63FB6ABFC9F1CC1FAD332628DF335104CC8B12334116A
    Session-ID-ctx:
    Master-Key: AE5369F1DFBDEC9A7E1670F8042242A9F75EFBFFA16ACF422F12CC92546A7A949BE0AADF5C61809E478CE2DD63261411
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 300 (seconds)
    TLS session ticket:
    0000 - 41 79 40 3c 3f 50 22 48-a0 8f c6 7f b2 4c 4c b3   Ay@<?P"H.....LL.
    0010 - 7f 0c 64 67 2d 59 1a 99-ea e5 5f 11 59 3e d4 a5   ..dg-Y...._.Y>..
    0020 - d9 98 de a9 25 a2 81 96-e5 ff 18 e8 45 ae bf fe   ....%.......E...
    0030 - 5f f1 f3 22 96 0d 2a 57-63 0b f9 c9 41 b1 47 3b   _.."..*Wc...A.G;
    0040 - fc 65 09 b6 ff 92 fb 93-4d ca 10 9f 13 b1 60 68   .e......M.....`h
    0050 - 85 ef 77 fd 33 4a ca 4d-95 f1 ed ad a3 4c b3 42   ..w.3J.M.....L.B
    0060 - 63 34 fa 19 88 46 db 5d-29 12 6e 2f f9 4d 43 b5   c4...F.]).n/.MC.
    0070 - 74 d6 64 0f e1 2b 68 c3-77 70 9a 9e 01 6b 7b e0   t.d..+h.wp...k{.
    0080 - 65 2e 90 00 c3 d8 d7 25-7f 7d 9b bf 5e 8c 06 f6   e......%.}..^...
    0090 - 7e 33 da 9e 5a 5c d9 b6-7b fc 7b fd 61 51 0b 1b   ~3..Z\..{.{.aQ..
    00a0 - 91 07 72 3c 85 fc e3 2f-1d 44 cb 53 01 a2 d4 89   ..r<.../.D.S....
    00b0 - c3 a5 d7 41 b8 61 0f b7-79 64 fd 46 b3 14 59 4b   ...A.a..yd.F..YK
    00c0 - e8 5d 00 ef f1 19 1f ae-2d ea c9 44 01 31 1f c6   .]......-..D.1..

    Start Time: 1581347153
    Timeout   : 7200 (sec)
    Verify return code: 21 (unable to verify the first certificate)
    Extended master secret: no