Not sure if makes sense to continue this here or if I should have started a new thread, but I've got a few questions relating to what's in the announcement : In the immediate future (earliest possible: today; latest possible: December 16th) we will begin issuance from our new R3 intermediate . Thi…

Shouldn't be a matter anyway @petercooperjr , the integration guide is very clear: For intermediate changes in particular, you should not hardcode the intermediate to use, but should use the Link: rel="up" header from the ACME protocol, since intermediates are likely to change.

when I first wrote a client several years ago, very very very few clients implemented this. i don't think certbot did this for quite some time either.

I would hope a client written many many years ago has seen some updates in the mean while? You can't just pretend you're an ostrich and stick your head in the sand..

We are keeping an eye on things to monitor the extent of any breakage due to this change. So far, we have observed very few domains continuing to serve the X3 intermediate in their chain despite having gotten an R3-issued end-entity cert during their scheduled renewal. For those few domains where we…

Indeed some DANE users had published TLSA records that match only X3. Since the announcement many have updated their TLSA records to also match R3/R4, but some have procrastinated . They'll have to make changes soon, it looks like X3 is now retired, and all new issuance is via R3. A handful of domai…

We're facing an issue with our IoT devices that were bundled with the intermediate certificate (X3) and when our server renew the certificate, they lost the ability to connect with server which prevent us from update them remotely. Is it possible to request a certificate based on the intermediate X…

What was your plan when X3 expired in 2021, or if they needed to bring the disaster recovery intermediate X4 online? If your servers followed the best practice of renewing every 60 days, you should still have your older server certificate somewhere that was signed by X3 that should expire at some p…

Thank you for your help and for the reference to that thread. Regarding your first question, we updated the application so it can load multiple certificates into a cert pool, which is then used by the client it tries to establish a connection with server. Regarding your suggestion to recover the o…

Luckily you've got a fairly recent backup from which you can pull the older certificate :wink:

Hi, My Salesforce client makes a callout to one of our internal services which has the new R3 intermediate cert. The integration is broken now. Salesforce maintains the list of trusted root certificates. Since the intermediate cert has changed, should I contact Salesforce to get their certificate c…

Questions re: Beginning Issuance from R3

Issuance Tech

Topic		Replies	Views
Issuance on R3 vs. X3: is this configurable? Issuance Tech	25	9102	November 24, 2020
R3 Intermediate certificate has expired Help	130	38726	October 2, 2021
Issue from multiple intermediates during a scheduled transition period? Issuance Policy	28	2534	January 12, 2021
Force X4 root in chain before it becomes default Help	27	4042	October 7, 2020
Potential problem with R3 intermediates on Windows servers Client dev	19	6507	August 10, 2021

Questions re: Beginning Issuance from R3

Related topics