As part of working on a brand new API, we use LetsEncrypt for generating ssl certificates. LetsEncrypts current X3-certificate expires at september 2021. They originally planned on making the X4 the default as of september 29 2021 (yesterday). But it turns out, they prolonged the change until Janu…

[image] _az: It depends what ACME client you use, but quite a lot of them now support selecting which root certificate to prefer. You just need to tell your client to prefer the "ISRG Root X1" certificate. As advertised for certbot here: Transition to ISRG's Root delayed until Jan 11 2021 - #…

I have a draft announcement for Certbot here which includes a one-liner (just replace DST Root CA X3 with ISRG Root X1). It hasn't been published yet, but might be helpful for you. Keep in mind that it will only kick in at your next renewal, so you might be better off manually substituting the secon…

If you are developing your own API and/or using a client library you should look at the Link sections of the response header returned when you request your cert (after completing domain validation): https://acme-v02.api.letsencrypt.org/acme/cert/abcd123 { Connection: keep-alive Link: <https://…

It would maybe be nice if letsencrypt.org (the main website, not the api etc) transitioned to the ISRG root now, so we could test clients apps/browsers by just pointing them to that site, or maybe there is a site to test with already?

@webprofusion Why would you use a main site as a testing environment? :confused:

Either way, that test site does exist: https://valid-isrgrootx1.letsencrypt.org/ (But don't trust your browser if it says DST Root CA X3, that's just some caching/shortcutting. Check with openssl)

As linked in the "Chain of Trust" page linked in the first comment to this thread :wink:

The alternate root is currently linked in the production environment, meaning it's ready for use in production, whether or not you consider it testing is relative.

Let's Encrypt themselves are postponing the date of using their own root certificate for production.. Would be weird to implement it on their main site anyway.

Easy to build an alternate chain that is valid till september 2021 . Is there a chance to use Intermediate CA R3 now ? B2B Websites do not really care about old android devices. Using R3 as intermediate CA would give me a setup that can run till 2025 without problems with expiry. Is there a softw…

[image] winnie13: Is there a chance to use Intermediate CA R3 now ? You can see from the search at crt.sh | % Free CT Log Certificate Search Tool from Sectigo (formerly Comodo CA) that there have been no certificates issued under this intermediate at…

Force X4 root in chain before it becomes default

Help

griffin October 2, 2020, 1:06am 20

Topic		Replies	Views
Please update the "Certificate Compatibility" page to include information about the new ISRG roots Site Feedback	22	3940	June 21, 2019
Issuance on R3 vs. X3: is this configurable? Issuance Tech	25	9127	November 24, 2020
Root CA for IOT Help	32	2390	February 14, 2021
R3 Intermediate certificate has expired Help	130	39501	October 2, 2021
Questions re: Beginning Issuance from R3 Issuance Tech	59	10107	December 22, 2020

Force X4 root in chain before it becomes default

Related topics