One of these certs is not like the others -DST Root CA X3 breaking antique hosts

@rg305 Yes, my comment that "LE has stopped including ISRG Root X1" recently seems to be wrong. Sorry for that.

However the certificate with the short chain from the OP was renewed on Nov 12, which was within the time window where the LE servers were apparently misconfigured (Shortening the Let's Encrypt Chain of Trust - #2 by aarongable). So the fact that he is seeing different chains indeed depends on the time the certs were last renewed.

3 Likes