Old R3 Intermediate Cert will impact the ISRG Root X1 Transition

If you were looking in the Local Computer's Intermediate store, try checking the Current User's Intermediate store instead. For example, compare the outputs of these two PowerShell commands.

# "CA" is the low level name for Intermediate Certifications Authorities
Get-ChildItem Cert:\LocalMachine\CA
Get-ChildItem Cert:\CurrentUser\CA

On my own Win10 machine, there's only 5 certs in LocalMachine\CA (none relating to Let's Encrypt) and 51 in CurrentUser\CA which includes a bunch of LE related stuff. It even has expired stuff like the old Let's Encrypt Authority X3 intermediate. It also varies by browser. IE, Edge, and Chrome (for the time being) use the Windows stores, but Firefox uses its own.

I believe the lazy loading is dependent on generally having outbound Internet access as well. Not sure what happens on systems that can't reach the greater Internet or have strict proxies in place.

3 Likes