New "Y" Root and Intermediate Hierarchy

We have completed our key ceremony resulting in the issuance of two new root certificates (ISRG Root YE and Root YR) and six new intermediates (Let's Encrypt YE1, YE2, YE3, YR1, YR2, and YR3). The new roots are cross-signed from our current ISRG Root X2 and ISRG Root X1 respectively.

We intend to submit this hierarchy for inclusion in various trust stores over the next few months, and will begin issuance from the new intermediates in 2026, in concert with our removal of the TLS Client Auth EKU

You can see all the details of the new certificates on our Chains of Trust page.

23 Likes