Any API to download the latest intermediate (R3) certificates

Your ACME client should be getting the new intermediate when renewing a certificate. Your current questions are not applicable at this time. You should focus on correctly setting up the ACME client used for when a new intermediate will be used.

By the way, Let's Encrypt may switch to the emergency recovery intermediate certificate R4 at any time. This is not something you can plan for. The only correct way to make sure such an emergency change will go without problems is when your ACME client uses the intermediate certificate send by the ACME server.

Please understand the above and refrain from trying to manage intermediate certificates manually.

5 Likes

I think there's a lot of confusion in this thread on what exactly you mean by "loading onto your devices". Which are these are you doing?

  1. These devices are TLS servers, and are getting their own certificates from Let's Encrypt.
  2. These devices are TLS clients, and are trying to connect to servers that already have certificates from Let's Encrypt.
  3. Both
  4. Something else?

In none of these cases above should you need to be loading the intermediate "manually". The only time you would be loading it "automatically" is in the first case, where the server should be getting the intermediate(s) from the ACME protocol and then being configured to serve the intermediates to the clients over the TLS protocol. But it's still not clear to me which situation you're describing.

4 Likes

What you are describing sounds like an anti-pattern in your application design - and specifically a usage that is not supported or recommended. As others have said, it is hard to determine exactly what you intend, but all information you have provided above points to an anti-pattern.

Client devices should ONLY need to have the Trusted Root, such as ISRG X1, installed. This should be handled by the Operating System or an Application's sandboxed trust store. Clients should not need Intermediates installed - those should be installed on your Server and provided to your Clients as part of the https protocol.

Servers should have the Trusted Root and Intermediates installed as their Chain/FullChain configuration, and the EndEntity (aka Leaf or Client) Certificate installed as their active certificate.

Beyond that, the ACME protocol is explicitly designed to issue Certificates alongside their Full Trust Chain, and the RFC explicitly states that Intermediates and Trust chains should not be hard-coded into clients, and that clients must expect these to change at any time.

While it is possible that your devices required a new R3 certificate to be installed, it is almost guaranteed this is because of a bug or architectural mistake in your application design. Attempting to work around these behaviors will only assume more technical debt, not solve your actual problems in any meaningful way.

8 Likes

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.