Correct ca bundle to use

"DST Root CA X3" is not, and I don't think has ever been used as, an intermediate certificate.
It is a ROOT certificate.
Thus, as such, should never be included in any bundle.

There are currently only two valid bundles (by bundle here I'm referring to the cert + chain).
Short path:
[leaf signed by R3], [R3 signed by "ISRG Root X1"]
Long path (default):
[leaf signed by R3], [R3 signed by "ISRG Root X1"], ["ISRG Root X1" signed by "DST Root CA X3"]

4 Likes