Questions re: Beginning Issuance from R3

[petercooperjr]

@aarongable

@petercooperjr

@aarongable

As usual, this will take the form of a phased rollout, beginning with us issuing a few certificates for ourselves, then allowing issuance in staging, then switching Prod to issue from R3. We will update this thread when these stages are in progress.

Can you clarify what it means that you'd be "allowing issuance in staging", when staging (I assume) wouldn't be signing from the real production R3? (Or maybe it will do "real" signing for some short length of time for testing?) Is it just that there would be new intermediates that will be started to get used in the staging environment? (And if so, I'd kind of expect that the order would be different, that staging changes would happen before issuing internal-to-Let's-Encrypt certificates?)

Still working with SRE on the final details here. Again, watch the API Announcements thread for updates.

So now that R3 is live in production (hooray!), I still don't see any changes in staging. (Or at least, a staging certificate that I just issued and one I tried a couple weeks ago are both signed by the same "Fake LE Intermediate X1".) Is there still a change expected in staging relating to this change?

@petercooperjr

My guess is that (one of the things) they're working on before bringing the new intermediates into service is updating the CPS . Section 7.1 only mentions the X<n> certificates, so I'm guessing they need to add at least the R<n> certificates there before they can be used. So keep your eyes peeled there if you want another hint of when they're about to use the new intermediates.

This guess of mine was apparently wrong, as the CPS section 7.1 still says that the CN of intermediates will be Let's Encrypt Authority X<n>. Is this a problem, or is that part of the CPS not actually authoritative but just describing the initial intermediates and not necessarily all active intermediates?