Potential problem with R3 intermediates on Windows servers

[Nummer378]

@webprofusion

As an aside does anyone know why http://r3.i.lencr.org/ (the from the certificate Authority Information Access) needs to return the expiring R3 instead of the new one?

This was already asked in the DST Root CA help thread, but we're still waiting for an official staff response.

@maxi322

When comes the time that the AIA-URL "http://r3.i.lencr.org/ " will serve the R3 Version that is signed by ISRG Root X1 and not the old R3 that is signed by DST Root CA X3 and is only valid until 29.09.2021?

This can become a problem with improperly configured servers where the client browser tries to load the intermediate from the AIA Server after September 2021.

I would guess that switchting the R3 AIA cert is a change LE is planning to make, but hasn't done this yet.