See our announcement here . If you have any questions, feel free to ask them in this thread.

[image] catharsis: since my RSA certificate is already using preferred_chain = ISRG Root X1, nothing will change for me on February 8th? Correct [image] catharsis: After February 8th, should I remove the preferred_chain (since it'll no longer be doing anything at that point) or leave it …

[image] catharsis: After February 8th, should I remove the preferred_chain (since it'll no longer be doing anything at that point) or leave it in place? Or does it matter? And nothing will change with my DSA certificate, right? I would leave the configuration in place. It is possible that L…

[image] jvanasco: IMHO, creating a new chainOptions endpoint to list current roots would be a good idea It doesn't need to be an ACME endpoint/option, or could also be a static file just like / or /build are.

[image] Osiris: It doesn't need to be an ACME endpoint/option, or could also be a static file just like / or /build are. If it were to be part of the spec, so that all ACME servers would implement it, it would need to be a URL advertised on /directory somehow. The implementation could be a s…

[image] jvanasco: { "availableRoots": [ "RSA": [ ["DST Root CA X3", "https://letsencrypt.org/certs/isrg-root-x1-cross-signed.pem"], ["ISRG Root X1", "https://letsencrypt.org/certs/isrgrootx1.pem"], ], "ECDSA": [ ["ISRG Root X1", "https://letsencrypt.or…

[image] Root X2 alternate chain for ECDSA opt-in accounts API Announcements W… ISRG Root X2 will be available as a chain option next week, with (STAGING) Bogus Broccoli X2 being deployed earlier today.

Very cool A tip for those who use the SSL Labs scanner at SSL Server Test (Powered by Qualys SSL Labs) their production scanner still doesn't like X2 but their dev scanner at SSL Server Test (Powered by Qualys SSL Labs) has supported it since November they haven't updated their production server…

Seems like the change has been implemented, I was able to get an E1 certificate with a chain.pem that's only 1021 bytes compared to 2599 before. Thank you very much!

[image] Osiris: [image] petercooperjr: You can configure your server to remove the last certificate in the chain if you don't want it to send the X2-signed-by-X1 (…) I'd recommend to check the certificate due for removal first if it's really the cross-signed X2 cert. Because if you'd hard…

The shortest chain does not include X2 at all. It's just leaf and E1. (X2 comes from system stores) And the only chain where you send X1 is the one using DST Root X3 as a trust anchor.

Questions regarding "Shortening the Let's Encrypt Chain of Trust"

Help

mcpherrinm August 2, 2023, 8:58pm 49

ISRG Root X2 will be available as a chain option next week, with (STAGING) Bogus Broccoli X2 being deployed earlier today.

How do I get the shortest ISRG Root X2 ECDSA chain now

Topic		Replies	Views
Certificate chain names Help	28	1905	December 27, 2023
Questions re: OpenSSL Client Compatibility Changes for Let’s Encrypt Certificates Issuance Tech	55	10384	September 7, 2021
--preferred-chain not taking effect Help	36	10666	December 17, 2021
Questions re: Extending Android Device Compatibility Issuance Tech	38	5059	March 21, 2021
How do I get the shortest ISRG Root X2 ECDSA chain now Help	31	2333	September 12, 2023

Questions regarding "Shortening the Let's Encrypt Chain of Trust"

Related topics