Changes in June 2021

I highly recommend subscribing to the API announcements here on the forums, as this is the place where you get exactly this kind of information.

The switch to the new long cross signed chain is currently planned for May 4. See the post below.

Theoretically, yes. Practically, it depends. A good acme client usually handles all intermediate certificates automatically, without requiring action from the subscriber. This means both that the transition on May 4 should not interrupt you and it also means that manual configurations/overrides/hacks on the intermediates are not recommended.

Last time I checked, Let's Encrypt currently does not offer the new-long chain in production as an "alternate chain" [alternate chains can be optionally downloaded by your acme client, if configured to do so]. However, they do offer a very similar test chain in their staging enviroment, so you could do test-runs over on staging.

If you really need to, you can theoretically manually download and serve the new long chain "by hand" thus overriding the chain selected by your acme client, as all signatures involved are compatible. This however requires you to fully manually manage your intermediate certificates, which is stronlgy not recommended. Your acme client should manage the chain served by your systems instead.

7 Likes