Help thread for DST Root CA X3 expiration (September 2021)

There is a test server that sends only the information to chain up to the ISRG Root X1 root: https://valid-isrgrootx1.letsencrypt.org/. It sends the leaf and the R3-signed-by-ISRG-Root-X1 intermediate, and so should be trusted if your client trusts ISRG Root X1. (But note that browsers may build other chains, so if you look in your web browser's certificate info you might also see the certificate of ISRG-Root-X1-signed-by-DST-Root-CA-X3 because your browser had seen that certificate elsewhere, even though the server itself didn't send it.)

There's also a test site that's configured with the "normal" chain rooted in DST Root CA X3, https://helloworld.letsencrypt.org/, but it hasn't renewed since the May 4 chain change so it's still using R3-signed-by-DST-Root-CA-X3 rather than the combo of R3-signed-by-ISRG-Root-X1 plus ISRG-Root-X1-signed-by-DST-Root-CA-X3.

Yes, if you request the "alternate" chain in your ACME client, it will send the chain without the ISRG-Root-X1-signed-by-DST-Root-CA-X3 certificate, so that your "root" can be the self-signed ISRG Root X1 in your trust store. This actually hasn't changed, and isn't expected to change for quite some time. The "valid-isrgrootx1" site mentioned above is set up the same way as a site that uses this approach. (See the great Production Chain Changes announcement that summarizes the plan.)

For the production chain, that is pretty true. But there is a staging environment, which is set up with a "mirror" of the real certs, except that the certificate corresponding to the DST Root CA X3 (called "(STAGING) Doctored Durian Root CA X3") is already expired.

So, what one could do, is have whatever system you're testing have both "(STAGING) Doctored Durian Root CA X3" and "(STAGING) Pretend Pear X1" in its trust store (be sure to remove after testing, as certificates from staging aren't audited or anything), or whichever combination of roots corresponds to the scenario you want to test. Then you can try using it to connect to systems that have been issued certificates from the staging environment (either the "normal" or "alternate" chain) to see what happens.

(Looks like @Nummer378 already said this while I was typing this up, but I already typed it so I'm leaving this here. :slight_smile: )


@jple: Just bugging you again. :slight_smile: Why isn't "(STAGING) Doctored Durian Root CA X3" mentioned or downloadable from the Staging Environment documentation? I'd think that needing to deal with it being or not being in one's trust store is the kind of thing that one would often be using the staging environment to test.

9 Likes