Cert verify failed: BADCERT_EXPIRED (Letsencrypt global root cert)

[biangbiangmian]

Another solution, which does not require making any changes on deployed devices:

Opkg (uclient-fetch) can't download from https site: Invalid SSL certificate (Letsencrypt global root cert expiration)

In my case editing the /etc/letsencrypt/site.name/fullchain.pem file to remove the last certificate and restarting nginx did it for me.