We had an outage today caused by cert-manager and letsencrypt. Letsencrypt changed their default chain from X1,DST X3 to just X1. But we had already included a config param to use only X1, and that param stopped working and instead gave us the unwanted DST X3 instead. Beware. More details in comme…

Cert-manager+LE giving unwanted DST X3 chain after Feb 8

mcpherrinm February 19, 2024, 7:08pm 8

This issue and workarounds are now documented on the cert-manager release notes

3 Likes

Topic		Replies	Views
--preferred-chain not taking effect Help	36	10414	December 17, 2021
DST Root CA X3 Expiration Help	16	2793	December 12, 2021
Should I add both DST Root CA X3 and ISRG Root X1 intermediates? Server	23	12427	September 6, 2018
Provide a valid certificate chain Help	9	1216	March 30, 2023
Force X4 root in chain before it becomes default Help	28	3804	November 6, 2020