Help thread for DST Root CA X3 expiration (September 2021)

You can already test this today, if you have control over both client and server that you're testing -

You can issue a cert from Let's Encrypts staging enviroment. Staging is specifically configured to serve a chain up to a root that is already expired. However, the staging certificates are not trusted, so you need to temporarily add the Let's Encrypt staging certificates to your trust store do test. (Remove them after you're done).

The test certificates used in staging are documented here: Staging Environment - Let's Encrypt

I host a test server that is configured to serve a staging chain, if you don't want to set that up yourself: https://expired-root-ca-test.germancoding.com. Remember to add the staging certificates to your trust store when testing, and don't forget to remove them after that.

PS: As I just saw that the LE staging documentation is a bit confusing, here's the staging root certificates you need to add for testing.

https://letsencrypt.org/certs/staging/letsencrypt-stg-root-x1.pem (This is a simulated "ISRG Root X1" certificate)

https://letsencrypt.org/certs/staging/letsencrypt-stg-root-dst.pem (This is a simulated "DST Root CA X3" that is already expired. Adding this to your trust store enables testing on how your trust store handles expired root certificates)

9 Likes