# Is Let's Encrypt going from savior to single point of failure (SPOF)?

**URL:** <https://community.letsencrypt.org/t/is-lets-encrypt-going-from-savior-to-single-point-of-failure-spof/60256>\
**Category:** ISRG/Organizational\
**Created:** [April 23, 2018, 4:32pm UTC](https://community.letsencrypt.org/t/is-lets-encrypt-going-from-savior-to-single-point-of-failure-spof/60256 "2018-04-23T16:32:04Z")\
**Posts on this page:** 1\
**Showing post:** 6

<div class="post-metadata">

**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\
**Post date:** [April 23, 2018, 5:28pm UTC](https://community.letsencrypt.org/t/is-lets-encrypt-going-from-savior-to-single-point-of-failure-spof/60256/6 "2018-04-23T17:28:04Z")

</div>

Let’s Encrypt can’t use the Let’s Encrypt Authority X3 intermediate to sign other intermediates.

```auto
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0

```

Let’s Encrypt could use the ISRG Root X1 certificate to sign other intermediates, but if that root continues to be valid, Let’s Encrypt could also use it to sign new _Let’s Encrypt_ intermediates in case there is a problem with the old ones. So, there might not be a lot of marginal benefit from this course of action.

I’m sure Let’s Encrypt staff would be happy to talk to anyone who wants to set up a new ACME-based CA on the Let’s Encrypt model.

---

_[View the full topic](https://community.letsencrypt.org/t/is-lets-encrypt-going-from-savior-to-single-point-of-failure-spof/60256)._