# Fetch root cert from ACME **URL:** \ **Category:** Feature Requests\ **Created:** [April 23, 2016, 10:05am UTC](https://community.letsencrypt.org/t/fetch-root-cert-from-acme/14796 "2016-04-23T10:05:20Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![aeris](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/aeris/32/74860_2.png) [@aeris](https://community.letsencrypt.org/u/aeris)\ **Post date:** [April 23, 2016, 10:05am UTC](https://community.letsencrypt.org/t/fetch-root-cert-from-acme/14796/1 "2016-04-23T10:05:21Z")
Hi, Currently, only the intermediary chain can be retrieved from ACME protocol (via `/acme/issuer-cert`), without the root LE cert. On production, you can hardcode the root cert (via [https://letsencrypt.org/certs/isrgrootx1.pem](https://letsencrypt.org/certs/isrgrootx1.pem)) on your automation tool, but on pre-prod (staging LE) or internal dev (custom boulder CA), it’s difficult to handle correctly the root selection. Root is needed for cert pinning/HPHP or DANE/TLSA, even more in the case of private key renewal each 90d (very risky/error-prone to pin the key, you need to pin an intermediary (with trouble if changed) or better the root cert). Why not include a `/acme/root-cert/` on ACME protocol ? ---
**Author:** ![kelunik](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/kelunik/32/359_2.png) [@kelunik](https://community.letsencrypt.org/u/kelunik)\ **Post date:** [April 23, 2016, 11:34am UTC](https://community.letsencrypt.org/t/fetch-root-cert-from-acme/14796/2 "2016-04-23T11:34:36Z")
> [@aeris](#): > > Root is needed for cert pinning/HPHP or DANE/TLSA, even more in the case of private key renewal each 90d (very risky/error-prone to pin the key, you need to pin an intermediary (with trouble if changed) or better the root cert). If you want to use HPKP, I'd suggest using the same key again or setting the max-age to 90 days, so you don't run issues locking users out. > [@aeris](#): > > Why not include a /acme/root-cert/ on ACME protocol ? You can parse the intermediate certificate and use the AIA URL to fetch the root certificate. ---
**Author:** ![aeris](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/aeris/32/74860_2.png) [@aeris](https://community.letsencrypt.org/u/aeris)\ **Post date:** [April 23, 2016, 1:28pm UTC](https://community.letsencrypt.org/t/fetch-root-cert-from-acme/14796/3 "2016-04-23T13:28:28Z")
> [@kelunik](#): > > setting the max-age to 90 days Don’t do this with key renew 60d or 90d. HPKP doesnt support key change from last change to last change + max age. See [here](https://twitter.com/aeris22/status/684513128143536128). Having 90d max-age with 60d key renew is a non sense (risk of HPKP break for clients). Having 90d max-age with 90d key renew put you vulnerable all the time (no way to renew the key before 90d after the last renew, key renew each 90d). To have HPKP working correctly, you need key renewal \>\>\> max-age (for example max-age 90d with key renew 1y = protected 75% of the time, and 98% with 10y key renew). The best with HPKP is to have stable key ’til compromission or weakness. > [@kelunik](#): > > You can parse the intermediate certificate and use the AIA URL to fetch the root certificate. For prod, AIA point to IdentTrust ([http://apps.identrust.com/roots/dstrootcax3.p7c](http://apps.identrust.com/roots/dstrootcax3.p7c)), no way to fetch the root LE cert ([https://letsencrypt.org/certs/isrgrootx1.pem](https://letsencrypt.org/certs/isrgrootx1.pem)). For staging, AIA is wrong ([http://cert.stg-int-x1.letsencrypt.org/](http://cert.stg-int-x1.letsencrypt.org/) is the intermediate, not root). For custom boulder (at least out-of-the-box, perhaps possible to change this), AIA is IdentTrust too. ---
**Author:** ![kelunik](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/kelunik/32/359_2.png) [@kelunik](https://community.letsencrypt.org/u/kelunik)\ **Post date:** [April 23, 2016, 1:44pm UTC](https://community.letsencrypt.org/t/fetch-root-cert-from-acme/14796/4 "2016-04-23T13:44:49Z")
> [@aeris](#): > > For prod, AIA point to IdentTrust ([http://apps.identrust.com/roots/dstrootcax3.p7c](http://apps.identrust.com/roots/dstrootcax3.p7c)), no way to fetch the root LE cert ([https://letsencrypt.org/certs/isrgrootx1.pem](https://letsencrypt.org/certs/isrgrootx1.pem)). LE root isn't used currently anyway. We don't even have X3 and X4 signed by the ISRG root yet. > [@aeris](#): > > For staging, AIA is wrong ([http://cert.stg-int-x1.letsencrypt.org/](http://cert.stg-int-x1.letsencrypt.org/) is the intermediate, not root). Then that's a bug which should be reported. > [@aeris](#): > > For custom boulder (at least out-of-the-box, perhaps possible to change this), AIA is IdentTrust too. Same here. Shouldn't point to IdenTrust. ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [May 23, 2016, 1:45pm UTC](https://community.letsencrypt.org/t/fetch-root-cert-from-acme/14796/5 "2016-05-23T13:45:11Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.