Force X4 root in chain before it becomes default

[Osiris]

@_az

It depends what ACME client you use, but quite a lot of them now support selecting which root certificate to prefer. You just need to tell your client to prefer the "ISRG Root X1" certificate.

As advertised for certbot here: Transition to ISRG's Root delayed until Jan 11 2021 - #2 by jsha