After my latest renewal with certbot the SSL connection broke as Issuer changed from R3 to R11

Help
6

Yes, because only the end leaf certificate without any intermediates are send:

---
Certificate chain
 0 s:CN = platform.rgsgames.com
   i:C = US, O = Let's Encrypt, CN = R11
   a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256
   v:NotBefore: Jun  8 06:33:03 2024 GMT; NotAfter: Sep  6 06:33:02 2024 GMT
---

Usually, that's only because the browser has cached the intermediate from some other connection. Although some browsers can also use the AIA CA Issuers information to retrieve the intermediate and use it to build the chain to the root.

But in the end you must make sure whatever is sending the certificate also sends the intermediate.

The following is what you SHOULD see (as an example):

---
Certificate chain
 0 s:CN = valid-isrgrootx1.letsencrypt.org
   i:C = US, O = Let's Encrypt, CN = R11
   a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256
   v:NotBefore: Jun  6 16:57:10 2024 GMT; NotAfter: Sep  4 16:57:09 2024 GMT
 1 s:C = US, O = Let's Encrypt, CN = R11
   i:C = US, O = Internet Security Research Group, CN = ISRG Root X1
   a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256
   v:NotBefore: Mar 13 00:00:00 2024 GMT; NotAfter: Mar 12 23:59:59 2027 GMT
---
4 Likes