New staging certs

jf043 · June 7, 2024, 6:22pm

new staging certs are failing because I cannot find the new staging certs to download anywhere?

They are not here

or here

Looking for this cert
CA /C=US/O=(STAGING) Let's Encrypt/CN=(STAGING) Counterfeit Cashew R10 (a368102c)

petercooperjr · June 7, 2024, 6:28pm

Yeah, they haven't updated the staging environment documentation yet. (I made a Github ticket for it a few days ago, but they've probably been too busy getting their new prod intermediates online.)

You can find one way to get the staging certs from this post:

So "Counterfeit Cashew R10" should be available from http://stg-r10.i.lencr.org/

But when you say "are failing", usually systems shouldn't care about the intermediates, since the server gets them from the ACME server when getting a cert and then sends them as part of the chain to the clients. If you're more specific about what you're doing, people here may be able to give you a better way. The intermediate you get can change with each certificate one gets.

mcpherrinm · June 7, 2024, 6:41pm

Sorry for the inconvenience. You're right it's been very busy getting everything going. I'll get the staging documentation updated soon. We have a batch of doc updates going out shortly now that the launch has happened.

(But as others have said, you shouldn't be in a situation where you're relying on our documentation that leads to failures)

Osiris · June 7, 2024, 6:46pm

I'm curious what would be failing and why exactly?

J50265 · June 9, 2024, 3:25am

Any idea when the new staging documentation is going to be available? My pipeline is down and we can't produce a new release of our product.

I tried both http://stg-r10.i.lencr.org/ and http://stg-r11.i.lencr.org/ to the get the DER files and added to my system the same way I did the old staging certs. Still getting (STAGING) Counterfeit Cashew R10 or (STAGING) Wannabe Watercress R11 not found when attempting to generate the certificate.

Osiris · June 9, 2024, 7:55am

Why would there be a need to include intermediate certificates to your system?

petercooperjr · June 9, 2024, 2:01pm

Especially intermediate staging certificates? Usually a server sends the intermediates to the client, and the client uses them to check against a root trust store. If you're building a custom root trust store that has the staging root certificates, I could see doing that but it's pretty unusual. Needing to include intermediates directly somewhere in that process sounds really broken. If you can explain exactly what your "pipeline" is trying to do, we can probably help you figure out the right way of doing it because intermediates can and will regularly change.

Nummer378 · June 9, 2024, 6:55pm

As others have already said, the ACME server gives you the intermediates, you don't need any external documentation to get them. Just for reference, here are all current staging intermediate certs in PEM format (not including cross signs, only default chains):

s:C = US, O = (STAGING) Let's Encrypt, CN = (STAGING) Counterfeit Cashew R10
i:C = US, O = (STAGING) Internet Security Research Group, CN = (STAGING) Pretend Pear X1

s:C = US, O = (STAGING) Let's Encrypt, CN = (STAGING) Wannabe Watercress R11
i:C = US, O = (STAGING) Internet Security Research Group, CN = (STAGING) Pretend Pear X1

s:C = US, O = (STAGING) Let's Encrypt, CN = (STAGING) Pseudo Plum E5
i:C = US, O = (STAGING) Internet Security Research Group, CN = (STAGING) Pretend Pear X1

s: C = US, O = (STAGING) Let's Encrypt, CN = (STAGING) False Fennel E6
i:C = US, O = (STAGING) Internet Security Research Group, CN = (STAGING) Pretend Pear X1

schoen · June 9, 2024, 7:21pm

It seems like @jf043 is doing this in order to create a working end-to-end test involving staging certificates (using them as part of a larger test environment that's as realistic and full-featured as possible).

Osiris · June 9, 2024, 7:27pm

@schoen Even so, what do intermediates have to do with that?

schoen · June 9, 2024, 7:29pm

Oh yeah, that's true, the most realistic test would indeed be to trust staging roots rather than staging intermediates.

jf043 · June 11, 2024, 1:35am

Yes, I have several full stack dev builds that have full chain health checks and other apps/clients need to trust the chain and signers as well. If you share and document root and intermediates certificates here:

and

they need to be updated with recent certificates.

Thank you.

webprofusion · June 11, 2024, 2:14am

@jf043 you should explicitly trust the root by including it in a list of trusted roots, then automatically trust intermediates signed by that root. That's the point of signing the intermediates.

Manually trusting intermediates means your chain validation will frequently break as intermediates change. Staging should be able to randomly introduce a new intermediate tomorrow and your trust chain should still work with no intervention.

Osiris · June 11, 2024, 9:10am

Ultimately only the roots are important. The intermediates are nice to know.

The Chains of Trust page is up to date and does not contain staging information. While I agree the staging environment page needs updating (there already is an issue opened on the Let's Encrypt website repository for this as mentioned before), but the roots have remained the same (according to Deploying Let's Encrypt's New Issuance Chains - #4 by mcpherrinm only the intermediates have changed).

So with changed intermediates but identical roots your system should not have any issue with these changes. If they do, then your systems are either faulty or should not error out but only warn on intermediate cert changes IMO.

system · July 11, 2024, 9:10am

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Staging Server Error Help	6	370	December 21, 2023
New issuer for letsencrypt staging Help	9	5520	March 22, 2021
Staging Hierarchy - New Root Cert Site Feedback	9	2037	March 21, 2021
Problem with staging environment Help	20	2779	July 7, 2018
Let's Encrypt Staging returning HTTP error 500 during order creation Help	4	54	August 17, 2024

New staging certs

Related topics