# Pin Sub CAs while issuing the certificates

**URL:** <https://community.letsencrypt.org/t/pin-sub-cas-while-issuing-the-certificates/221473>\
**Category:** Help\
**Created:** [July 9, 2024, 6:19am UTC](https://community.letsencrypt.org/t/pin-sub-cas-while-issuing-the-certificates/221473 "2024-07-09T06:19:13Z")\
**Posts on this page:** 1\
**Showing post:** 14

<div class="post-metadata">

**Author:** ![Bruce5051](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/bruce5051/32/76576_2.png) [@Bruce5051](https://community.letsencrypt.org/u/Bruce5051)\
**Post date:** [July 9, 2024, 3:24pm UTC](https://community.letsencrypt.org/t/pin-sub-cas-while-issuing-the-certificates/221473/14 "2024-07-09T15:24:37Z")

</div>

To me it seems most clients do not properly understand or use chains. This appears to be going on for years. ☹

> [@Verifying a certificate](https://community.letsencrypt.org/t/verifying-a-certificate/187233/5):
>
> Summary: a certificate verifier shouldn't assume that the served chain is the one true path to one specific root. Instead, consider it as a pool of helpful but untrusted certificates, which may be informative in the certificate verifier's attempt to find a path to some root that it trusts.

---

_[View the full topic](https://community.letsencrypt.org/t/pin-sub-cas-while-issuing-the-certificates/221473)._