# CA Certificate does not match http://cps.root-x1.letsencrypt.org (https://letsencrypt.org/documents/isrg-cps-v2.3/) **URL:** \ **Category:** Issuance Tech\ **Created:** [September 14, 2018, 9:50pm UTC](https://community.letsencrypt.org/t/ca-certificate-does-not-match-http-cps-root-x1-letsencrypt-org-https-letsencrypt-org-documents-isrg-cps-v2-3/72254 "2018-09-14T21:50:30Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![youser](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/youser/32/26167_2.png) [@youser](https://community.letsencrypt.org/u/youser)\ **Post date:** [September 14, 2018, 9:50pm UTC](https://community.letsencrypt.org/t/ca-certificate-does-not-match-http-cps-root-x1-letsencrypt-org-https-letsencrypt-org-documents-isrg-cps-v2-3/72254/1 "2018-09-14T21:50:31Z")
I got a Let’s Encrypt certificate for me (i.e.: my server). Inspecting the certificate I found his certification chain: - “DST Root CA X3” (Root CA) - “Let’s Encrypt Authority X3” (CA) - some\_really\_ugly\_name The CA states the CPS as [http://cps.root-x1.letsencrypt.org](http://cps.root-x1.letsencrypt.org) (the Root CA has no such CPS), and that, in turn, states the Root CA is “ISRG Root X1” using 4096 bits. The X3 CA however uses just 2048 bits. My certificate has the CPS [http://cps.letsencrypt.org](http://cps.letsencrypt.org), which redirects to [https://letsencrypt.org/documents/isrg-cps-v2.3/](https://letsencrypt.org/documents/isrg-cps-v2.3/) also. Shouldn’t the CPS describe the certification policy? I’m quite confused.8-( ---
**Author:** ![\_az](https://avatars.discourse-cdn.com/v4/letter/_/22d042/32.png) [@\_az](https://community.letsencrypt.org/u/_az)\ **Post date:** [September 14, 2018, 10:00pm UTC](https://community.letsencrypt.org/t/ca-certificate-does-not-match-http-cps-root-x1-letsencrypt-org-https-letsencrypt-org-documents-isrg-cps-v2-3/72254/2 "2018-09-14T22:00:11Z")
> ISRG CA root Private Keys are RSA keys at least 4096 bits in length. This quote is true because DST Root CA X3 is not an ISRG root, it's operated by IdenTrust. Check "Cross-Signing" on [Chain of Trust - Let's Encrypt](https://letsencrypt.org/certificates/) to see how it all comes together. Not sure about the CPS not describing the cross-signing setup. ---
**Author:** ![jsha](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jsha/32/12_2.png) [@jsha](https://community.letsencrypt.org/u/jsha)\ **Post date:** [September 14, 2018, 11:42pm UTC](https://community.letsencrypt.org/t/ca-certificate-does-not-match-http-cps-root-x1-letsencrypt-org-https-letsencrypt-org-documents-isrg-cps-v2-3/72254/3 "2018-09-14T23:42:19Z")
CPS stands for “Certification Practices Statement.” There’s also a document called the CP, or “Certificate Policy.” I know, it’s very confusing. 🙂 Can I ask, what is the problem you are trying to solve? Is there a regulatory compliance issue that requires you to document key strength for your entire certification chain? ---
**Author:** ![youser](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/youser/32/26167_2.png) [@youser](https://community.letsencrypt.org/u/youser)\ **Post date:** [September 17, 2018, 7:05am UTC](https://community.letsencrypt.org/t/ca-certificate-does-not-match-http-cps-root-x1-letsencrypt-org-https-letsencrypt-org-documents-isrg-cps-v2-3/72254/4 "2018-09-17T07:05:19Z")
> [@jsha](#): > > Can I ask, what is the problem you are trying to solve? Curiosity: I found out that the Root CA has no CPS at all, and the intermediate CA has a conflicting CPS (that seems to belong to a different CA, actually). ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [October 17, 2018, 7:05am UTC](https://community.letsencrypt.org/t/ca-certificate-does-not-match-http-cps-root-x1-letsencrypt-org-https-letsencrypt-org-documents-isrg-cps-v2-3/72254/5 "2018-10-17T07:05:33Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.