Can someone else confirm - I do not have any Let's Encrypt-issued certificates, but I have been encountering problems with the chain-of-trust in certificates issued to vendors as early as 2026-05-28 22:50:39Z. I am still working with two vendors to determine if they have configured an invalid chain-…

Let's Encrypt are currently only serving unexpired and valid certificates. That certificate hasn't been used since 2024 . What's probably happening is that there's a cache in your system which doesn't get rid of old or expired certificates. Edit: This is only a problem now as YE/YR are now used for…

The issue isn't in the certificates that Let's Encrypt issued to the servers, since the chain provided in the ACME protocol includes the updated correctly signed unexpired certificates. It's likely to be something wrong with how those servers are configured, since they should be serving the chain wh…

It's not my system that has the expired certificate in cache and multiple new tests through SSLLabs on Friday and today show that SSLLabs is receiving the expired certificate in the additional certificates supplied by the server. I was also able to pull this same chain, sent from the server, on my h…

Right, but what my fellow volunteers are saying is that those servers are sending the invalid chain. You really need to work with them to get that chain corrected. Or, refer them here for assistance. I think those servers are sending a "custom" chain they created themselves. Perhaps by removing…

Yes, it looks like those two servers are sending expired cross-sign versions in their ECDSA chains. I don't think there's anything Let's Encrypt or this forum can do about it. If the operators of those servers want to post here explaining how they configure their servers to serve the chains from the…

I currently have support tickets open with both vendors to look at their servers as well. One has passed to their engineering department to investigate, no response from the other yet. I suspect both are having their servers hosted by third parties, so another layer of diffusion in getting the detai…

[image] AdrianJ1: I suspect both are having their servers hosted by third parties, so another layer of diffusion in getting the details to correct person... it may take a while As noted in the post below, Cloudflare has an incident involving a subset of Let's Encrypt certs. If your two servi…

Possible expired ISRG Root X2 cert included in chain starting ~May28th?

Help

MikeMcQ June 2, 2026, 12:58pm 9

As noted in the post below, Cloudflare has an incident involving a subset of Let's Encrypt certs. If your two services are using Cloudflare services it may be worth giving them the link to that incident report:

Topic		Replies	Views
Chain has the wrong root certificate (update: no it doesn't) Help	3	545	September 14, 2023
ISRG Root X1 expiring... Please confirm the latest cert Help	10	1680	September 17, 2024
ISRG Root X2 (Cross-signed by 'ISRG Root X1') Issuance Tech	14	780	July 11, 2025
Cloudflare provisioned expired X2 cross-sign Help	3	250	June 2, 2026
Wrong dates in Chain of Trust Page Site Feedback	11	705	May 23, 2024

Possible expired ISRG Root X2 cert included in chain starting ~May28th?

Related topics