Staging Hierarchy - New Root Cert

[chrisjoneslut]

As announced here: (Staging Hierarchy Changes)
the staging root was updated yesterday to new roots. We use the staging roots for testing in our dev environments as described on the staging environment page, putting those roots in our trust store.

The docs for the staging env (Staging Environment - Let's Encrypt - Free SSL/TLS Certificates) still have links to the old staging root. Where can the new root be found and could someone please update the page to have the correct root?

Thanks!

[rakkhin]

It's the same issue as New issuer for letsencrypt staging, something must have gone wrong during the maintenance. Our testing environments are busted as well.

[jillian]

@chrisjoneslut

The docs for the staging env (Staging Environment - Let's Encrypt - Free SSL/TLS Certificates ) still have links to the old staging root. Where can the new root be found and could someone please update the page to have the correct root?

This documentation page was an oversight during the improvements and changes to the Staging hierarchy. We will be working to get it fully updated today.

In the meantime, the Staging roots are available in similar naming scheme to the production Issuer URI.

Staging X1 http://stg-x1.i.lencr.org
Staging DST http://stg-dst3.i.lencr.org

You can fetch these endpoints to get the DER encoded certificates.

[rittneje]

@jillian The Staging X1 certificate you linked is the one signed by the (expired) Staging DST. Do you have the link for the self-signed Staging X1 certificate, as show in the diagram on this page? Extending Android Device Compatibility for Let's Encrypt Certificates - Let's Encrypt - Free SSL/TLS Certificates

[jillian]

We are working to update the chains served by the staging front ends and update the website to have all the certs so you can manually configure any chain you’d like. Thanks for your patience while we make these changes.

[jillian]

I updated the API Announcement Thread for the Staging Hierarchy Changes

@jillian

The Staging Environment web page is now updated with details about the new Staging Root and Intermediate.

In the next few days and weeks we'll be making more changes to the Staging Environment so it will better match Production and offer a useful test environment for upcoming production changes like the chain switch and signing from our ECDSA roots and intermediates (noted as 'upcoming').

Addtionally, we noticed our test hierarchy has the wrong AIA CA Issuers URI and CRL Distribution Point URI on the certificate: (STAGING) Artificial Apricot R3 signed by (STAGING) Doctored During Root CA X3 . That fix will be done in the next few days too.

The front ends should also be serving an updated default chain that make more sense.

[chrisjoneslut]

Thank you for making the updates! We've updated our root and our env is working again.

[saudiqbal]

Do I need to update my certbot if I want X2 certs?

[aarongable]

X2 certs (i.e. certs issued from our ECDSA intermediate E1) are not yet available, and the changes to staging which will make them available there have not yet happened either. That'll be a separate change.