Issuance on R3 vs. X3: is this configurable?

If you'd like to see it for yourself, https://valid-isrgrootx1.letsencrypt.org/ is a test site currently signed by X3 and serving the intermediate which is signed by ISRG Root X1. There's nothing special or unique that Let's Encrypt needed to do in order to set this up; you could do it yourself if you started serving the intermediate signed by ISRG Root X1 on your own web site. The only difference on Jan. 11 is them changing the default chain returned by the ACME server.

4 Likes