Cert-manager+LE giving unwanted DST X3 chain after Feb 8

Osiris · February 18, 2024, 8:41am

If that's the case, how would that option have worked when the long chain was the default? It would never have selected the X1 short chain with such logic.

Or would it only have searched in the alternative chains? Because then it could work indeed with just a single alternative chain offered anyway.

By the way, for anyone who wondered: Certbot does not have this bug due to the fact it includes the default chain when searching for the selected issuer common name (and it also only looks at the last certificate in the chain):

github.com

certbot/certbot/blob/v2.9.0/certbot/certbot/_internal/client.py#L344-L348


      
          fullchain = orderr.fullchain_pem
          if self.config.preferred_chain and orderr.alternative_fullchains_pem:
              fullchain = crypto_util.find_chain_with_issuer(
                  [fullchain] + orderr.alternative_fullchains_pem,
                  self.config.preferred_chain, not self.config.dry_run)

And the other part of this bug (also looking at intermediate certs) was fixed in Certbot 1.12.0 back in the beginning of 2021. Alt-chain selection was introduced in 1.6.0 which also looked at the default chain, but stopped looking at intermediates.