# Note regarding transition to R3 intermediate with Firefox or Thunderbird

**URL:** <https://community.letsencrypt.org/t/note-regarding-transition-to-r3-intermediate-with-firefox-or-thunderbird/140049>\
**Category:** Help\
**Created:** [December 8, 2020, 11:44am UTC](https://community.letsencrypt.org/t/note-regarding-transition-to-r3-intermediate-with-firefox-or-thunderbird/140049 "2020-12-08T11:44:37Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![webprofusion](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/webprofusion/32/85310_2.png) [@webprofusion](https://community.letsencrypt.org/u/webprofusion)\
**Post date:** [December 8, 2020, 11:44am UTC](https://community.letsencrypt.org/t/note-regarding-transition-to-r3-intermediate-with-firefox-or-thunderbird/140049/1 "2020-12-08T11:44:37Z")

</div>

If anyone finds they are suddenly having trouble with Firefox or Thunderbird connecting to services that use Let's Encrypt certificates, check that your certificate includes the new R3 intermediate in the certificate chain.

Thunderbird (for instance) has a copy of the old X3 certificate in it's store, but not the R3, this means that if you previously skipped having the intermediate in your certificate chain file (which is usually a pem format file) and perhaps only used a certificate file with your leaf/end-entity certificate, then the certificate will no longer validate properly on some clients.

---

<div class="post-metadata">

**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\
**Post date:** [December 8, 2020, 2:43pm UTC](https://community.letsencrypt.org/t/note-regarding-transition-to-r3-intermediate-with-firefox-or-thunderbird/140049/2 "2020-12-08T14:43:07Z")

</div>

> [@webprofusion](#):
>
> check that your certificate includes the new R3 intermediate in the certificate chain

That _should_ happen automatically of course though 😉

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [December 8, 2020, 6:50pm UTC](https://community.letsencrypt.org/t/note-regarding-transition-to-r3-intermediate-with-firefox-or-thunderbird/140049/3 "2020-12-08T18:50:39Z")

</div>

Yes... and no.

Yes, it should chain to it [may require additional client lookup to pass validation].

No, it wouldn't be included automatically when `cert.pem` is used alone.  
[only when the `fullchain.pem` file is used (or `cert` + `CA bundle` - depending on ACME client)]  
[and it would definitely NOT be included when the wrong intermediate cert is included - LOL]

---

<div class="post-metadata">

**Author:** ![webprofusion](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/webprofusion/32/85310_2.png) [@webprofusion](https://community.letsencrypt.org/u/webprofusion)\
**Post date:** [December 9, 2020, 1:02am UTC](https://community.letsencrypt.org/t/note-regarding-transition-to-r3-intermediate-with-firefox-or-thunderbird/140049/4 "2020-12-09T01:02:01Z")

</div>

Yes, in the case of certify it does pull down the chain and bundle it as a PFX, it's subsequent conversions by the user (or using the various export options) for use with various services/servers that may be missing the intermediate.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\
**Post date:** [January 8, 2021, 1:09am UTC](https://community.letsencrypt.org/t/note-regarding-transition-to-r3-intermediate-with-firefox-or-thunderbird/140049/5 "2021-01-08T01:09:07Z")

</div>

Closed on January 8, 2021, 1:09am UTC

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.