Issue certificate on R3 intermediate

All publicly-trusted certificates are logged, primarily so that people can confirm that the Certificate Authorities are doing their job correctly, but also so that site owners can learn about all certificates that have been issued for their domains.

But I wouldn't treat it as a "backup" on its own.

Make sure your update changes your devices to only have roots in the trust store. Intermediates should be sent by the server as part of the TLS connection, the client should only care about the root. And for devices like what it sounds like you're using, you probably want more than one root in its trust store, perhaps including one you create yourselves. Let's Encrypt is great, but if their system goes down for an extended time or they need to change their root certificate due to a compliance issue or whatnot, you want the flexibility to be able to switch to another CA if needed.

6 Likes