# Howto obtain a full certificate chain without a cross-signed ISRG Root X1 **URL:** \ **Category:** Help\ **Created:** [October 1, 2021, 2:24pm UTC](https://community.letsencrypt.org/t/howto-obtain-a-full-certificate-chain-without-a-cross-signed-isrg-root-x1/161445 "2021-10-01T14:24:01Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![jow](https://avatars.discourse-cdn.com/v4/letter/j/7cd45c/32.png) [@jow](https://community.letsencrypt.org/u/jow)\ **Post date:** [October 1, 2021, 2:24pm UTC](https://community.letsencrypt.org/t/howto-obtain-a-full-certificate-chain-without-a-cross-signed-isrg-root-x1/161445/1 "2021-10-01T14:24:01Z")
Hi, I am looking for a way to obtain a certificate chain through Let's Encrypt that does not append a cross-signed ISRG Root X1 certificate at the end. Right now, when requesting a certificate for a domain using the latest acme.sh client, I receive a certificate chain which includes a ISRG Root X1 that is cross-signed by the DST Root CA X3, for Android compatibility I presume. Sources on the web, like the OpenSSL compatibility blog entry here: [Old Let’s Encrypt Root Certificate Expiration and OpenSSL 1.0.2 - OpenSSL Blog](https://www.openssl.org/blog/blog/2021/09/13/LetsEncryptRootCertExpire/) (Workaround #3) suggest to "Configure the server to use the alternative certificate chain which can be requested from Let’s Encrypt with most up-to-date ACME protocol clients." which, I guess, translates to the "preferred chain" option that was implemented in most clients a while back. My problem is that both using `--preferred-chain "ISRG Root X1"` or `--preferred-chain "DST Root CA X3"` will produce me a certificate chain that contains the cross-signed X1 CA cert. I could manually edit the resulting cert chain and remove or replace the offending X1 CA cert with a non-cross-signed one (e.g. taken from the Let's Encrypt website) but I'd prefer to request a proper one in the first place. Is there any "preferred chain" value that will tell the Let's Encrypt servers to produce a chain that contains a _non-cross-signed_ ISRG Root X1? Or am I facing a potential client specific issue? For reference, there's also a pending issue against acme.sh describing my particular problem: > > > Steps to reproduce > \------------------ > > Note: unsure if that could happen for …newly issued certificate. In our case, this happened on an existing certificate we just renewed (\`--renew --force ...\`) > > Deploy a Let's Encrypt certificate, eg: > > \`\`\` > acme.sh --install-cert -d mydomain.com \\ > \--cert-file /etc/nginx/certs/mydomain.crt \\ > \--key-file /etc/nginx/certs/mydomain.key \\ > \--fullchain-file /etc/nginx/certs/mydomain-full.crt \\ > \--reloadcmd "systemctl reload nginx.service" > \`\`\` > > where nginx is provided the fullchain: > > \`\`\` > server { > listen 443 ssl; > server\_name mydomain.com; > > ssl\_certificate /etc/nginx/certs/mydomain-full.crt; > ssl\_certificate\_key /etc/nginx/certs/mydomain.key; > > ... > } > \`\`\` > > Issue > \----------------- > > The problem is that the fullchain contains an obsolete root certificate (\`ISRG Root X1\`), which means nginx emit the following certificates to the client: > > 1. the domain's certificate > 2. the \`R3\` intermediate certificate > 3. the \`ISRG Root X1\` certificate (old one, signed by \`DST Root CA X3\`) > > On Windows clients (and maybe other platforms), when nginx sends the \`ISRG Root X1\` to the client, the Windows validation procedure evaluate it could be an intermediate certificate signed by \`DST Root CA X3\` which is now expired. There is an alternative path using the newer \`ISRG Root X1\` in store but it seems Windows strategy is to fail first. > > !\[image\](https://user-images.githubusercontent.com/805632/135583313-79ca5f59-d280-49d2-96bd-e8fd5fd2bb99.png) > > > Solution > \----------------- > > Manually remove the \`ISRG Root X1\` from the fullchain file and restart nginx server. In this case, the \`R3\` validation is done against the correct / up-to-date / trusted \`ISRG Root X1\` and it succeed. So the chain file for nginx should only contain: > > 1. the domain's certificate > 2. the \`R3\` intermediate certificate > > !\[image\](https://user-images.githubusercontent.com/805632/135583620-2bc49b60-b168-44f5-b1fb-35234123d381.png) > > The problem is there is no way to call \`acme.sh\` to generate a file with just the domain certificate followed by \*only\* intermediate certificate(s). Or at least a way to generate a file with the intermediate certificate(s) - without the root ca. > > Alternatively, \`acme.sh\` should append the correct root certificate. I am not interested in extended Android compatibility but I need to support (unmodified) OpenSSL 1.0.2 clients as well as older wolfSSL clients that exhibit similar logic problems as OpenSSL 1.0.2 (rejecting the entire cert because one of the alternative chains is expired). ---
**Author:** ![Tugzrida](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/tugzrida/32/53376_2.png) [@Tugzrida](https://community.letsencrypt.org/u/Tugzrida)\ **Post date:** [October 1, 2021, 2:41pm UTC](https://community.letsencrypt.org/t/howto-obtain-a-full-certificate-chain-without-a-cross-signed-isrg-root-x1/161445/2 "2021-10-01T14:41:54Z")
> [@jow](#): > > My problem is that both using `--preferred-chain "ISRG Root X1"` or `--preferred-chain "DST Root CA X3"` will produce me a certificate chain that contains the cross-signed X1 CA cert. What certbot version are you using? Using `--preferred-chain "ISRG Root X1"` will get you the leaf \< R3 \< ISRG Root X1 chain you are looking for **for certbot versions 1.12.0 and newer** ---
**Author:** ![jow](https://avatars.discourse-cdn.com/v4/letter/j/7cd45c/32.png) [@jow](https://community.letsencrypt.org/u/jow)\ **Post date:** [October 1, 2021, 2:53pm UTC](https://community.letsencrypt.org/t/howto-obtain-a-full-certificate-chain-without-a-cross-signed-isrg-root-x1/161445/3 "2021-10-01T14:53:01Z")
Thank you, it works for me too, now. My mistake was trying to switch the preferred chain during a certificate update, I had to re-issue the certificate completely instead of updating it (in acme.sh terms) for the setting to become effective. ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [October 31, 2021, 2:53pm UTC](https://community.letsencrypt.org/t/howto-obtain-a-full-certificate-chain-without-a-cross-signed-isrg-root-x1/161445/4 "2021-10-31T14:53:52Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.