# ISRG Root X1 replaces DST Root CA X3? **URL:** \ **Category:** Help\ **Created:** [September 28, 2021, 2:44pm UTC](https://community.letsencrypt.org/t/isrg-root-x1-replaces-dst-root-ca-x3/160678 "2021-09-28T14:44:01Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![jcarbo](https://avatars.discourse-cdn.com/v4/letter/j/73ab20/32.png) [@jcarbo](https://community.letsencrypt.org/u/jcarbo)\ **Post date:** [September 28, 2021, 2:44pm UTC](https://community.letsencrypt.org/t/isrg-root-x1-replaces-dst-root-ca-x3/160678/1 "2021-09-28T14:44:01Z")
Hello, We've been installed the ISRG Root X1 and R3. Our DST Root CA X3 expire in two days, and it's not renovated in the Let's Encript website. Can we asume the ISRG Root X1 replaces DST Root CA X3 ? Regards, Jordi ---
**Author:** ![Nummer378](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/nummer378/32/49862_2.png) [@Nummer378](https://community.letsencrypt.org/u/Nummer378)\ **Post date:** [September 28, 2021, 2:46pm UTC](https://community.letsencrypt.org/t/isrg-root-x1-replaces-dst-root-ca-x3/160678/2 "2021-09-28T14:46:37Z")
> **[DST Root CA X3 Expiration (September 2021) - Let's Encrypt](https://letsencrypt.org/docs/dst-root-ca-x3-expiration-september-2021/)** > > On September 30 2021, there will be a small change in how older browsers and devices trust Let’s Encrypt certificates. If you run a typical website, you won’t notice a difference - the vast majority of your visitors will still accept your... ---
**Author:** ![jcarbo](https://avatars.discourse-cdn.com/v4/letter/j/73ab20/32.png) [@jcarbo](https://community.letsencrypt.org/u/jcarbo)\ **Post date:** [September 28, 2021, 3:22pm UTC](https://community.letsencrypt.org/t/isrg-root-x1-replaces-dst-root-ca-x3/160678/3 "2021-09-28T15:22:02Z")
Hello @Nummer378, I understand what your saying. In my SAP system an alert pops up that the certificate is going to expire. My question is: Can I delete the DST Root CA X3 certificate because I already have the ISRG Root X1 installed? Regards, Jordi ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [September 28, 2021, 5:53pm UTC](https://community.letsencrypt.org/t/isrg-root-x1-replaces-dst-root-ca-x3/160678/4 "2021-09-28T17:53:51Z")
What do you mean with "installed"? What's the situation? Is your system a CLIENT or a SERVER? I just don't understand the situation, due to lack of information. Please enlighten us by describing your situation as detailed as possible. ---
**Author:** ![jcarbo](https://avatars.discourse-cdn.com/v4/letter/j/73ab20/32.png) [@jcarbo](https://community.letsencrypt.org/u/jcarbo)\ **Post date:** [September 29, 2021, 6:54am UTC](https://community.letsencrypt.org/t/isrg-root-x1-replaces-dst-root-ca-x3/160678/5 "2021-09-29T06:54:59Z")
> [@jcarbo](#): > > ISRG Root X1 i Hello there, In the SAP servers, we have imported the certificates to be able to communicate with other clients. As we have imported the DST Root CA X3 certificate, we get an alert saying that it will expire on September 30. We have imported the new ISRG Root X1 and R3 certificates. Can we remove the DST Root CA X3? ---
**Author:** ![webprofusion](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/webprofusion/32/85310_2.png) [@webprofusion](https://community.letsencrypt.org/u/webprofusion)\ **Post date:** [September 29, 2021, 7:50am UTC](https://community.letsencrypt.org/t/isrg-root-x1-replaces-dst-root-ca-x3/160678/6 "2021-09-29T07:50:55Z")
Check the chain being served by the SAP services (which your SAP GUI etc will connect to), or your web interface (NetWeaver?). If it's no longer using DST Root CA X3 (it is `Your Cert > R3 > ISRG Root X1` , not `Your Cert > R3 > ISRG Root X1 > DST Root CA X3`) and all your clients are happy with that then you don't need DST Root CA X3 anymore. On a local machine you can check your service using (port 443 is the example but you may be using a different port): `openssl s_client -showcerts -connect your.domain.com:443 -servername your.domain.com` There are two versions of ISRG Root X1, one is self signed and the other is cross signed by DST Root CA X3. The cross signed one is used as an intermediate and is more compatible with some older clients that don't know about ISRG Root X1. So you need to choose whether you still need the longer DST Root CA X3 chain or whether you can just use ISRG Root X1 (self signed). Note that is you are still seeing a chain of `Your Cert > R3 > DST Root CA X3` this will become invalid tomorrow, so I think you'd need to add the current R3 and remove the old one (issued by DST Root CA X3). ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [October 29, 2021, 7:51am UTC](https://community.letsencrypt.org/t/isrg-root-x1-replaces-dst-root-ca-x3/160678/7 "2021-10-29T07:51:49Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.