According to the announcement the shortest X2 chain should be available now. How do I get it now without the X1 chain, I am already on the production allow list and using it since it started in 2021. Currently this is what I use to get X2 cert. acme.sh --issue ... --keylength ec-256 --server lets…

[image] saudiqbal: --preferred-chain "ISRG Root X2" Just wanted to make sure is --preferred-chain "ISRG Root X2" the correct command to get X2 only chain?

That is the addition to the command that I would expect will work, but I don't know as anybody has tested yet. :slight_smile:

It's working now. Note how my chain3.pem is about half the size of the older chains: root@uk2:/etc/letsencrypt/archive/other# ls -l total 48 -rw-r--r-- 1 root root 1424 Aug 3 23:26 cert1.pem -rw-r--r-- 1 root root 1363 Aug 7 12:16 cert2.pem -rw-r--r-- 1 root root 1359 Aug 9 11:21 cert3.pem -rw-…

Here's the command I used to test it: certbot --config "${X2_CFG}" certonly --domains valid-isrgrootx2.letsencrypt.org --preferred-chain="ISRG Root X2" And here's the default API return: https://acme-v02.api.letsencrypt.org/acme/cert/03700fa6ab0c0767e26c578708bd7064c8c2/0 and the alt return: ht…

For some reason I cannot get acme.sh to get X2 only chain. I used --preferred-chain "ISRG Root X2" --keylength ec-256

I'm unsure of the actual semantics of acme.sh for its implementation of --preferred-chain. Taking a quick look at https://github.com/acmesh-official/acme.sh/blob/0da839cce35f4ab014a6d62133fac03c8f4c6979/acme.sh#L5157 , it appears that it'll try to match the issuer, but it's not clear to me that it's …

[image] jcjones: I know initial implementations of this logic tended to match cross-signs, which would in this case catch the default chain and not the alternate. Jup, AFAIK Certbot was buggy in that way too in the beginning, but it was (obviously) fixed quite soon :slight_smile:

How are you checking the chain, my domain is iqbal.email

How do I get the shortest ISRG Root X2 ECDSA chain now

Help

jcjones August 9, 2023, 4:49pm 12

Your account needs to be opted in to the ECDSA issuer path, at present. See Root X2 alternate chain for ECDSA opt-in accounts.

Topic		Replies	Views
Questions regarding "Shortening the Let's Encrypt Chain of Trust" Help	92	8304	June 10, 2024
Renewing X2-by-X1 cross-signed root Issuance Tech	38	1627	May 16, 2024
Is using preferred-chain "ISRG Root X2" still a good idea? Issuance Policy	9	427	June 11, 2026
Choice of default long chain vs short chain Issuance Policy	53	5254	November 1, 2021
Certificate chain names Help	28	1905	December 27, 2023

How do I get the shortest ISRG Root X2 ECDSA chain now

Related topics