Hi, I am working to implement download of alternate chains in acme-tiny . At the moment I am working at the staging area. The first download from https://acme-staging-v02.api.letsencrypt.org/acme/cert/<hash-id> returns a chain of three certificates. The ordered, and two intermediate ("Artificial A…

[image] steelman: BTW It would be nice to have more than one chain available at staging to develop software capable of choosing between available chains. We are working on making multiple alertnate chains available in Staging in preparation for the multiple alternate chains that will be avail…

The Staging API should now serve a default chain of EE <-- R3 <-- X1 <-- DST3 (expired) and alternate chain of EE <-- R3 <-- X1 I am afraid that at this very moment only the latter chain is available. And if requested via /1 url X1 is not sent to a client. Anyway, thanks for a swift reply. Since…

[image] steelman: I am afraid that at this very moment only the latter chain is available. And if requested via /1 url X1 is not sent to a client. After fixing the default chain to be the long chain, Let's Encrypted tested by issuing certficates with Certbot and verified the long chain like s…

Any updates on alternative chains? Also docs are not consistent regarding staging chain Staging Environment - Let's Encrypt The staging environment intermediate certificate ( "(STAGING) Artificial Apricot R3" ) is issued by a root certificate not present in browser/client trust stores. If you wish …

For the staging environment... This was the primary chain of issuance: Leaf (STAGING) Artificial Apricot R3 (STAGING) Doctored Durian Root CA X3 (not served) This is the primary chain of issuance: Leaf (STAGING) Artificial Apricot R3 (STAGING) Pretend Pear X1 (STAGING) Doctored Durian Root C…

Hi @griffin , both provided links for primary and alternate Artificial Apricot R3 point to the same certificate file from primary chain. Issue still stands.

There are two different (STAGING) Pretend Pear X1 certificates. Both use the same private key and thus either can be used to authenticate (STAGING) Artificial Apricot R3. The one signed by (STAGING) Doctored Durian Root CA X3 is this one: [image] rakkhin: certificate with thumbprint 2534c02f1d…

Incomplete alternate certificate chains at staging area

Issuance Tech

jillian February 23, 2021, 2:33am 5

If was this problem, it should be resolved now. Stay tuned for more changes to the Staging environment including multiple alternate chains.

Topic		Replies	Views
(STAGING) Doctored Durian Root CA X3 is expired (breaks test environment) Help	24	9778	March 5, 2021
Workflow for using alternate link relation Issuance Tech	11	3831	November 23, 2021
New staging certs Help	13	1969	June 11, 2024
Confused about the different certificate chains in staging Help	7	1597	August 28, 2023
Chain.pem with two entries - DST Root CA X3 deprecate Help	8	3956	December 29, 2021

Incomplete alternate certificate chains at staging area

Related topics