Staging Hierarchy Changes

[jillian]

The Let's Encrypt team has made the final fixes to the hierarchy. The Staging hierarchy now mirrors the hierarchy in Production with one notable difference.

The (STAGING) Doctored Durian Root CA X3 certificate was issued with a now passed expiration date.

@aarongable

This is intentional. The Doctored Durian Root CA X3 staging root is an analogue for the real DST Root CA X3 , which will expire in September of this year. See our previous announcements and discussions (both in this forum and on the blog ) about why we are offering a chain with an expired root as the default chain, while offering a chain with a non-expired but slightly-less-widely-trusted root as the alternate chain.

We backdated the expiration of Doctored Durian Root CA X3 precisely so that folks who interact with staging would see these sorts of issues now, rather than when the real DST Root CA X3 expires later this year. If your use case requires that the trust root be not expired, you need to request the alternate chain.

In addition, the Staging Environment offers a default chain that is comparable to the future Production default noted above. Staging's default chain is now:
(STAGING) Artificial Apricot R3 <-- (STAGING) Pretend Pear X1 <-- (STAGING) Doctored Durian Root CA X3