Just looking at these two issues, it seems like many users are radically unprepared for changes in intermediate certificates: [image] Obtaining a letsencryp certificate with the old intermediate "X3"? Issuance Tech H… [image] Can not issue X3 chain …

It's a good idea in general! It's hard in practice. In particular, I'm totally willing to say that its still going to be another couple weeks before we're ready to issue from two different intermediates side-by-side (a feature we're going to use for RSA and ECDSA) at all. Having that feature in pla…

Can we have "emergency escape" endpoint from x4 with shorter lifetime (like a week) (different boulder config)? Or it's just a hsm sit on a shelf and don't have real server for it?

Just a couple random thoughts I've had along these lines: Would it ever make sense to use different intermediates on different servers at the same time? My understanding is that there are two main data centers, so if there was one intermediate for one data center and one for the other, then at lea…

The recent switch exposed those that set their constraints so tight that even the smallest (and expected) change broke their connections. Lessons learned for those that put their hands in that fire. But that won't stop others from doing that exact same thing (even as we speak, odds are someone is). …

[image] rg305: But that won't stop others from doing that exact same thing (even as we speak, odds are someone is). Here is one now: Keep "Let's Encrypt Authority X3" for renewed certificate - Help - Let's Encrypt Community Support

In retrospect, it's been very confusing to people that both "DST Root X3" and "Let's Encrypt Authority X3" have "X3" in the name and expire around the same time. If nothing else, it'd be good to try to avoid that confusion at much as possible in the future. I might suggest that the next ISRG Root (a…

Personally, I'd like a scheme something like: Let's Encrypt Root YYYYMMDD RSA Let's Encrypt Root YYYYMMDD ECC Let's Encrypt Intermediate YYYYMMDD RSA Let's Encrypt Intermediate YYYYMMDD ECC YYYY = issuance year MM = issuance month DD = issuance day That way there's absolutely zero ambiguity …

[image] griffin: Personally, I'd like a scheme something like: Let's Encrypt Root YYYYMMDD RSA Let's Encrypt Root YYYYMMDD ECC Let's Encrypt Intermediate YYYYMMDD RSA Let's Encrypt Intermediate YYYYMMDD ECC It seems redundant. That's an UI problem, the certificate already contains all tha…

Imagine if you went by the nickname Eduardo. To affirmatively reference who you really are I'd have to either know Eduardo is Tom or scan your identification documents. Since one less familiar with you won't have the luxury of the former, they're left with the latter. You are Tom, aren't you? …

I must agree. I'm all for saving space... but this is too much. Two letters just isn't quite enough. What's to stop anyone else from calling their next CA/Intermediates "R3" or "R4"? There should be some uniformity in the name.

[image] rg305: What's to stop anyone else from calling their next CA/Intermediates "R3" or "R4"? In what way does that matter? Right, in no way at all. :slight_smile:

Issue from multiple intermediates during a scheduled transition period?

Issuance Policy

rg305 January 8, 2021, 8:26am 6

Here is one now:
Keep "Let's Encrypt Authority X3" for renewed certificate - Help - Let's Encrypt Community Support

Topic		Replies	Views
Questions re: Beginning Issuance from R3 Issuance Tech	59	9932	December 22, 2020
Intermediate change announced in tech newsletter? Help	3	164	September 2, 2025
Let's Encrypt New Intermediate Certificates Issuance Tech	60	6470	January 8, 2024
Policy for new root keys? Issuance Policy	18	4143	April 7, 2016
Issuance on R3 vs. X3: is this configurable? Issuance Tech	25	9003	November 24, 2020

Issue from multiple intermediates during a scheduled transition period?

Related topics