Hello community, Since May 10th we started having certificate with new certification chain (ISRG Root X1 -> R3 -> mydomain.com ). We have a lot of connected IoT that are sensible to certification chain changes. Is it normal ? I have been reading official communication that said it will start only a…

Welcome to the Let's Encrypt Community :slightly_smiling_face: This contains the information you seek: [image] Production Chain Changes API Announcements M…

Thank you for your quick reply. I cannot find it written clearly, but if I undertand correctly, their is no way to use the « old chain », only new « default chain » and « alternate chain » are available ?

You are correct. The default and alternate chains currently available both have leaf <- R3 <- ISRG Root X1. For the default chain, the ISRG Root X1 is actually signed by DST Root CA X3 and included with R3 and your certificate when you have a certificate issued to you. This may help though: The cu…

[image] rjs: but if I undertand correctly, their is no way to use the « old chain », only new « default chain » and « alternate chain » are available ? While not recommended it's always possible to build your own chain. The cross-signed R3 intermediate is valid until Sep 29 19:21:40 2021 GMT.…

I never heard it was possible to manually build our own chain. Is there a tutorial explaining how to do it ?

It's pretty easy. Get your new certificate chain issued from Let's Encrypt Put only the first certificate in the issued chain (your leaf) and the R3 certificate signed by DST Root CA X3 to which I gave you the download link ( @Osiris 's link is informational, while mine is the actual R3 certificate …

Do note that this is not recommended, as the intermediate used to sign your certificate could change any moment and without any notification what so ever. I.e., the intermediate R4 could suddenly be the signing intermediate in case of an incident with R3. Would such a thing happen and you'd still be…

@griffin : Thanks a lot! I've just tried it and it works perfectly. @Osiris : You talk about error in browsers, but in our case (IoT device that embed root certificate), is it problematic ? What is the probability that the intermediate certificate change ?

Hi @rjs [image] rjs: You talk about error in browsers, but in our case (IoT device that embed root certificate), is it problematic ? never hardcode intermediate certificates, that's a simple rule. Browsers are tolerant, they add the chain. Other clients are critical. They may fail. So if y…

[image] rjs: @Osiris : You talk about error in browsers, but in our case (IoT device that embed root certificate), is it problematic ? Especially IoT devices are at risk of being completely locked out, we've seen that on this Community when the recent intermediate change happened. [image] …

Issue certificate using the IdentTrust « old chain » - #12 by JuergenAuer - Help

Topic		Replies	Views	Activity
Create certificate using predefined ca root Help	18	2562	December 13, 2020
Certbot returns certificates with the old certificate chain Issuance Tech	31	4946	May 17, 2021
Certbot users: Preparing for the ISRG Root transition (January 11 2021) Client dev	0	6619	November 11, 2020
What is the chain to pass to --preferred-chain argument to keep using DST Root X3 root certificate? Help	31	13761	November 11, 2020
Force X4 root in chain before it becomes default Help	27	3982	October 7, 2020