# Staging Hierarchy Changes

**URL:** <https://community.letsencrypt.org/t/staging-hierarchy-changes/145633>\
**Category:** API Announcements\
**Created:** [February 18, 2021, 10:03pm UTC](https://community.letsencrypt.org/t/staging-hierarchy-changes/145633 "2021-02-18T22:03:44Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![jillian](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jillian/32/11635_2.png) [@jillian](https://community.letsencrypt.org/u/jillian)\
**Post date:** [February 18, 2021, 10:03pm UTC](https://community.letsencrypt.org/t/staging-hierarchy-changes/145633/1 "2021-02-18T22:03:44Z")

</div>

Today February 18, 2021, we updated our staging environment to better match Production. All certificates in Staging are being signed by `(STAGING) Artificial Apricot R3` and chain to our new Staging root `(STAGING) Doctored Durian Root CA X3`. We’ve also created comparable certs for R4, E1, E2, X1, and X2 that we will be able to issue from in Staging before enabling them in Production.

---

<div class="post-metadata">

**Author:** ![jillian](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jillian/32/11635_2.png) [@jillian](https://community.letsencrypt.org/u/jillian)\
**Post date:** [February 19, 2021, 9:01pm UTC](https://community.letsencrypt.org/t/staging-hierarchy-changes/145633/2 "2021-02-19T21:01:46Z")

</div>

The [Staging Environment](https://letsencrypt.org/docs/staging-environment/) web page is now updated with details about the new Staging Root and Intermediate.

In the next few days and weeks we'll be making more changes to the Staging Environment so it will better match Production and offer a useful test environment for upcoming production changes like the [chain switch](https://letsencrypt.org/2020/11/06/own-two-feet.html) and signing from our ECDSA roots and intermediates ([noted as 'upcoming'](https://letsencrypt.org/certificates/#root-certificates)).

Addtionally, we noticed our test hierarchy has the wrong AIA CA Issuers URI and CRL Distribution Point URI on the certificate: `(STAGING) Artificial Apricot R3` signed by `(STAGING) Doctored Durian Root CA X3`. That fix will be done in the next few days too.

---

<div class="post-metadata">

**Author:** ![jillian](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jillian/32/11635_2.png) [@jillian](https://community.letsencrypt.org/u/jillian)\
**Post date:** [February 23, 2021, 2:28am UTC](https://community.letsencrypt.org/t/staging-hierarchy-changes/145633/3 "2021-02-23T02:28:32Z")

</div>

This issue was resolved during this [brief maintenance window](https://letsencrypt.status.io/pages/maintenance/55957a99e800baa4470002da/60345a3df8636505b2a46799).

> [@jillian](#):
>
> Addtionally, we noticed our test hierarchy has the wrong AIA CA Issuers URI and CRL Distribution Point URI on the certificate: `(STAGING) Artificial Apricot R3` signed by `(STAGING) Doctored Durian Root CA X3` . That fix will be done in the next few days too.

---

<div class="post-metadata">

**Author:** ![jillian](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jillian/32/11635_2.png) [@jillian](https://community.letsencrypt.org/u/jillian)\
**Post date:** [February 26, 2021, 2:13am UTC](https://community.letsencrypt.org/t/staging-hierarchy-changes/145633/4 "2021-02-26T02:13:17Z")

</div>

The Let's Encrypt team has made the final fixes to the hierarchy. The Staging hierarchy now mirrors the [hierarchy in Production](https://letsencrypt.org/certificates/) with one notable difference.

The `(STAGING) Doctored Durian Root CA X3` certificate was issued with a now passed expiration date.

> [@(STAGING) Doctored Durian Root CA X3 is expired (breaks test environment)](https://community.letsencrypt.org/t/staging-doctored-durian-root-ca-x3-is-expired-breaks-test-environment/145689/2):
>
> This is intentional. The `Doctored Durian Root CA X3` staging root is an analogue for the real [DST Root CA X3](https://crt.sh/?id=8395), which will expire in September of this year. See our previous announcements and discussions (both in this forum and [on the blog](https://letsencrypt.org/2020/12/21/extending-android-compatibility.html)) about why we are offering a chain with an expired root as the default chain, while offering a chain with a non-expired but slightly-less-widely-trusted root as the alternate chain.
> 
> We backdated the expiration of `Doctored Durian Root CA X3` precisely so that folks who interact with staging would see these sorts of issues now, rather than when the real `DST Root CA X3` expires later this year. If your use case requires that the trust root be not expired, you need to request the alternate chain.

In addition, the Staging Environment offers a default chain that is comparable to the _future_ Production default noted above. Staging's default chain is now:  
`(STAGING) Artificial Apricot R3 <-- (STAGING) Pretend Pear X1 <-- (STAGING) Doctored Durian Root CA X3`
