Question: Let’s Encrypt Intermediate Certificate Rotation

[Shubhendu]

Hi everyone,

We’re pinning Let’s Encrypt’s intermediate certificate in our applications, and we want to make sure we’re ready when it gets rotated so we don’t run into any downtime.

A couple of things we’re hoping to clarify:

1. Is there a published schedule for intermediate certificate rotations?
2. What’s the best way to get notified ahead of time when a rotation is coming?

Basically, we want to make sure we can update pinned certificates in time without affecting our apps. Any advice, tips, or pointers to relevant docs would be super helpful.

Thanks a lot!

[aarongable]

Do not pin Let's Encrypt intermediates. If you must pin something, either pin the roots (like any other trust store) or pin your end-entity certificates (over which you have full control).

@Shubhendu

Is there a published schedule for intermediate certificate rotations?

There is not.

@Shubhendu

What’s the best way to get notified ahead of time when a rotation is coming?

Watch the API Announcements category here on the forum, but even that is not a guarantee: we may rotate intermediates at any time with no warning.

[Osiris]

@Shubhendu

We’re pinning Let’s Encrypt’s intermediate certificate in our applications (…)

Why?