# Cert Chain issue **URL:** \ **Category:** Help\ **Created:** [April 26, 2023, 7:21am UTC](https://community.letsencrypt.org/t/cert-chain-issue/197153 "2023-04-26T07:21:25Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Datawolk](https://avatars.discourse-cdn.com/v4/letter/d/da6949/32.png) [@Datawolk](https://community.letsencrypt.org/u/Datawolk)\ **Post date:** [April 26, 2023, 7:21am UTC](https://community.letsencrypt.org/t/cert-chain-issue/197153/1 "2023-04-26T07:21:25Z")
Hi All, My domain is: [https://appservices.mobisol.be/](https://appservices.mobisol.be/) Command: sudo certbot --nginx Output: ![MW63juz0eE](https://global.discourse-cdn.com/letsencrypt/original/3X/0/7/073817a22bc993bd6c3512b1e78fa418a2024d05.png) OS: Ubuntu 20.04.6 LTS nginx/1.18.0 (Ubuntu) This API is used for mobile apps. There is no problem for IOS, but there is for Android devices. When we check the Cert Chain I come across this issue. > **[DST Root CA X3 Expiration (September 2021) - Let's Encrypt](https://letsencrypt.org/docs/dst-root-ca-x3-expiration-september-2021/)** > > Update September 30, 2021 As planned, the DST Root CA X3 cross-sign has expired, and we’re now using our own ISRG Root X1 for trust on almost all devices. For more details about the plan, keep reading! We have also updated our Production Chain... It's just not clear to me how to solve this. Does an adjustment have to be made to the App / API / or the way I generate the certificate? Thanks in advance! Kind regards, Chris ---
**Author:** ![webprofusion](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/webprofusion/32/85310_2.png) [@webprofusion](https://community.letsencrypt.org/u/webprofusion)\ **Post date:** [April 26, 2023, 7:44am UTC](https://community.letsencrypt.org/t/cert-chain-issue/197153/2 "2023-04-26T07:44:00Z")
> [@Datawolk](#): > > [https://appservices.mobisol.be/](https://appservices.mobisol.be/) You are using the standard "long" chain that Let's Encrypt offers by default, this exists (using the expired) root or general compatability with older devices. You can optionally use the newer unexpired `ISRG Root X1` issuer using `--preferred-chain "ISRG Root X1"` Are you sure the problem is certificate chain? Which version of Android is having problems? ---
**Author:** ![Datawolk](https://avatars.discourse-cdn.com/v4/letter/d/da6949/32.png) [@Datawolk](https://community.letsencrypt.org/u/Datawolk)\ **Post date:** [April 26, 2023, 8:14am UTC](https://community.letsencrypt.org/t/cert-chain-issue/197153/3 "2023-04-26T08:14:23Z")
I used the "--preferred-chain" option and it seems solved, still need to do some testing. But on auto-renewal, is this certificate using the "correct" chain again? ---
**Author:** ![webprofusion](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/webprofusion/32/85310_2.png) [@webprofusion](https://community.letsencrypt.org/u/webprofusion)\ **Post date:** [April 26, 2023, 8:16am UTC](https://community.letsencrypt.org/t/cert-chain-issue/197153/4 "2023-04-26T08:16:34Z")
I believe it will but I think you can check your /certbot/renewal/.conf file to confirm the options it will use upon renewal. ---
**Author:** ![Datawolk](https://avatars.discourse-cdn.com/v4/letter/d/da6949/32.png) [@Datawolk](https://community.letsencrypt.org/u/Datawolk)\ **Post date:** [April 26, 2023, 8:59am UTC](https://community.letsencrypt.org/t/cert-chain-issue/197153/5 "2023-04-26T08:59:00Z")
That seems right indeed! Thank you! ![DjsB45JorI](https://global.discourse-cdn.com/letsencrypt/original/3X/a/4/a488eac9fa0afcda19d481e021db1b849a7a5c6b.png) ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [May 26, 2023, 8:59am UTC](https://community.letsencrypt.org/t/cert-chain-issue/197153/6 "2023-05-26T08:59:28Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.