Issue description Couple of days ago, I noticed some issues at my automated curl requests. The issues appear after a renewal of some LE certificates. I was able to trace back the problems to an incomplete validation of my LE TLS certifications chain. A missing ISRG Root YR cert in my local CA trust …

it'd be normal to see it there: things like https://valid.x1.test-certs.letsencrypt.org/ already using Y tier signed certificate at its leaf, just including cross-sign certificate from YE/YR to X2/X1.

[image] Shiphoo5: I opened this new topic, because I think many people could come across this issue, because many(?) major linux distributions do not provide the ISRG Root YE/YR within ins ca-certificates packages. That's entirely normal, since the new YE and YR Root Certificates haven't been…

[image] ghen: That's entirely normal, since the new YE and YR Root Certificates haven't been submitted to any root programs yet , including Mozilla's Root Program, where the ca-certificates trust store is sourced from. This is not true, we are getting new certificates signed by YR2 and things …

[image] azurit: we are getting new certificates signed by YR2 and things are broken as Root YR is not in trust anywhere. The Root YR does not have to be in the trust anchor store, because the TLS server supposed to send it (actually a cross-signed version) to the TLS client. Then, this certif…

[image] bruncsak: The Root YR does not have to be in the trust anchor store, because the TLS server supposed to send it (actually a cross-signed version) to the TLS client. Then, this certificate chains up to a trusted root certificate X2, or definitely to X1 as the client searches for a valid t…

Here it is: Chains of Trust - Let's Encrypt

[image] azurit: This is not true, we are getting new certificates signed by YR2 and things are broken as Root YR is not trusted anywhere. That's why you have the YR <= X1 cross-cert in the chain. YR is not a trust anchor (yet), X1 is. But soon there will be disjoint sets of clients trusting…

Even valid LE YR has broken Chain of trust - https://valid.yr.test-certs.letsencrypt.org/ Start 2026-06-10 17:34:53 -->> 52.34.89.55:443 (valid.yr.test-certs.letsencrypt.org) <<-- Further IP addresses: 52.24.183.97 54.189.78.235 rDNS (52.34.89.55): ec2-52-34-89-55.us-west-2.comput…

Yes, the valid.yr.test-certs.letsencrypt.org site is intended for systems that are testing having Root YE & YR in their trust stores. But they aren't in any major trust stores yet, and so no server intended to be used by the general public would be set up the same way as that testing site; they'd be…

Chain validation issues with YE/YR under Linux distributions

Help

Topic		Replies	Views
Today (re)issued Certificates from Issuer YR2 have a Revoked Cert in Chain Help	14	1181	June 3, 2026
Issue - Unable to verify certificate chain - CentOS7 Help	34	4724	August 6, 2022
Should I add both DST Root CA X3 and ISRG Root X1 intermediates? Server	23	12663	September 6, 2018
Certificates requested through acme.sh are not issued as ISRG Root X1 Help	15	813	November 11, 2024
Mozilla's certificate bundle is out of date Help	38	5696	October 8, 2021

Chain validation issues with YE/YR under Linux distributions

Related topics