As part of working on a brand new API, we use LetsEncrypt for generating ssl certificates. LetsEncrypts current X3-certificate expires at september 2021. They originally planned on making the X4 the default as of september 29 2021 (yesterday). But it turns out, they prolonged the change until Janu…

[image] _az: It depends what ACME client you use, but quite a lot of them now support selecting which root certificate to prefer. You just need to tell your client to prefer the "ISRG Root X1" certificate. As advertised for certbot here: Transition to ISRG's Root delayed until Jan 11 2021 - #…

The X4 intermediate certificate is only used as a backup and won't be used unless something terrible has happened to the X3 intermediate. I think you've got the certs mixed up. See the full certificate hierarchy: [image] Source: Chain of Trust which also contains all the intermediate certificat…

[image] SRYER: I struggle to find out if it is possible for me to force my LetsEncrypt to use the new X4-certificate. This way, our new customers on the new API will be faced with potential ceritificate issues upfront (if there servers don't trust the X4) To this point - yes, it is possible t…

Thank you so much for the clarification. You are absolutely right; I mixed up the certificates and your assumptions of my question was right. I am using certbot. Question A) Does your solution of " you could change your webservers certificate chain to contain the intermediate certificate signed…

[image] SRYER: Does your solution of " you could change your webservers certificate chain to contain the intermediate certificate signed by ISRG Root X1." imply, that I edit the pem-chain file manually after generating the certificate? Or is there are more fail-safe way to do it automatically us…

[image] Osiris: re-issue those certs with that new flag set to the ISRG root How exactly can I flag my certbot execution to use the certification? Do you have a link or a copy/paste ready one-liner I can go test out? Thanks again for all your time on this. Your and the other replier's help i…

[image] SRYER: How exactly can I flag my certbot execution to use the certification? Do you have a link or a copy/paste ready one-liner I can go test out? Please see the URL I linked above... I've never worked with that option before.

Sorry, just missed your link there. I will go dive into this. Thanks

I have a draft announcement for Certbot here which includes a one-liner (just replace DST Root CA X3 with ISRG Root X1). It hasn't been published yet, but might be helpful for you. Keep in mind that it will only kick in at your next renewal, so you might be better off manually substituting the secon…

If you are developing your own API and/or using a client library you should look at the Link sections of the response header returned when you request your cert (after completing domain validation): https://acme-v02.api.letsencrypt.org/acme/cert/abcd123 { Connection: keep-alive Link: <https://…

It would maybe be nice if letsencrypt.org (the main website, not the api etc) transitioned to the ISRG root now, so we could test clients apps/browsers by just pointing them to that site, or maybe there is a site to test with already?

Force X4 root in chain before it becomes default

Help

Osiris September 30, 2020, 9:17am 4

As advertised for certbot here: Transition to ISRG's Root delayed until Jan 11 2021 - #2 by jsha

Topic		Replies	Views
Please update the "Certificate Compatibility" page to include information about the new ISRG roots Site Feedback	22	3841	June 21, 2019
Issuance on R3 vs. X3: is this configurable? Issuance Tech	25	9020	November 24, 2020
Root CA for IOT Help	32	2308	February 14, 2021
R3 Intermediate certificate has expired Help	130	38036	October 2, 2021
Questions re: Beginning Issuance from R3 Issuance Tech	59	9935	December 22, 2020

Force X4 root in chain before it becomes default

Related topics