You are supposed to have all 10 TLSA records for R10-R14 and E5-E9 on both fqdns (open "backup" to find the rest: Chains of Trust - Let's Encrypt) because the intermediate will change without warning (10 to 11 and 5 to 6 randomly, and probably the others too).
5 Likes