Is there anything different our acme client needs to do to retrieve with the trust chain changed to R3 from X3? I've seen topics elsewhere say this change will happen in the fall, but no further information. Will it be an additional alternate link relation or will R3 just one day replace X3 as the i…

[image] griffin: What part of "R3 will begin being automatically served along with the leaf" per "ACME clients will, by default, serve a certificate chain that leads to ISRG Root X1" is confusing? The part where you're mixing two separate "events". You keep talking about root certificates, wh…

[image] griffin: I'm really confused at the confusion. Was the date listed below not published by jsha? Jan. 11 is when the default chain will change which root is signing the intermediate. There's no date yet published that I know of on when the intermediate will be changing. It's possible t…

[image] griffin: I didn't realize X3 was signed by ISRG Root X1. Yes, everything currently in use is ISRG Root X1 signed and IdenTrust DST Root X3 cross-signed. Although R3 currently isn't in use, it is signed by both roots too.

[image] griffin: I didn't realize X3 was signed by ISRG Root X1. If you'd like to see it for yourself, https://valid-isrgrootx1.letsencrypt.org/ is a test site currently signed by X3 and serving the intermediate which is signed by ISRG Root X1. There's nothing special or unique that Let's Enc…

And just to be clear because in all our discussion I want to be sure this question actually gets answered: [image] tiday: does my client have control of switching from one to the other No, your client has no control over which intermediate Let's Encrypt uses for signing, and in theory it sho…

While R3 isn't active yet, I suspect that it's going to go live very soon™. The cross-sign variant of X3 (the IdenTrust one) expires on Mar 17 16:40:46 2021 GMT. Since Let's Encrypt leaf certificates are always 90 days valid, and a leaf certificate can't be valid for longer than the intermediate, t…

As I understand it, (2) matters for the following reason: the X3 intermediate expires Mar 17 16:40:46 2021 GMT. So, that means as of Dec 17 or so certs issued from this will have lifetimes longer than the intermediate from which they were issued, which I've been told is a CA/B forum violation. I hop…

The intermediates (both X3 and R3) are both signed by DST Root X3 and ISRG Root X1, yes. But this is talking about the certificate chain being served, usually called fullchain.pem. This file consists of "your" certificate (signed by the intermediate) and the intermediate (signed by a root). You can'…

Well, before Jan. 11 the served certificate chain only leads to DST Root X3. Afterward, the chain only leads to ISRG Root X1. In both cases it only goes to one root, they're just changing which root it is (but you can choose to use the other chain if you want to).

[image] griffin: Aren't ALL of the LE RSA intermediate certificates already signed by ISRG Root X1 (and thus "lead" to both ISRG Root X1 and DST Root X3)? Should the quote above actually read: As of January 11, 2021, we’re planning to make a change to our API so that ACME clients will, by defa…

Issuance on R3 vs. X3: is this configurable?

Issuance Tech

Topic		Replies	Views
Questions re: Beginning Issuance from R3 Issuance Tech	59	9921	December 22, 2020
Force X4 root in chain before it becomes default Help	27	3970	October 7, 2020
Transition from X3 to R3 Intermediate Issuance Tech	3	4762	October 3, 2020
Beginning Issuance from R3 API Announcements	2	20595	December 2, 2020
Issue from multiple intermediates during a scheduled transition period? Issuance Policy	28	2449	January 12, 2021

Issuance on R3 vs. X3: is this configurable?

Related topics