Fetch root cert from ACME

[kelunik]

@aeris

For prod, AIA point to IdentTrust (http://apps.identrust.com/roots/dstrootcax3.p7c), no way to fetch the root LE cert (https://letsencrypt.org/certs/isrgrootx1.pem).

LE root isn't used currently anyway. We don't even have X3 and X4 signed by the ISRG root yet.

@aeris

For staging, AIA is wrong (http://cert.stg-int-x1.letsencrypt.org/ is the intermediate, not root).

Then that's a bug which should be reported.

@aeris

For custom boulder (at least out-of-the-box, perhaps possible to change this), AIA is IdentTrust too.

Same here. Shouldn't point to IdenTrust.