# Still getting R3 certificates **URL:** \ **Category:** Help\ **Created:** [December 29, 2021, 6:46pm UTC](https://community.letsencrypt.org/t/still-getting-r3-certificates/168589 "2021-12-29T18:46:52Z")\ **Posts on this page:** 6\ **Page:** 2
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [December 30, 2021, 9:24am UTC](https://community.letsencrypt.org/t/still-getting-r3-certificates/168589/22 "2021-12-30T09:24:41Z")
It _might_ but every CA I know uses intermediate certificates, so there's absolutely no guarantee of the future. _Maybe_ Kestrel is "smart" enough to load and serve the correct intermediate when switching to the other CA (probably because [ASP.NET](http://ASP.NET) doesn't have an older intermediate cached/stored somewhere), but what if that CA also switches intermediates? The issue here is [ASP.NET](http://ASP.NET) for some magical and unknown reason sends the utterly incorrect chain while not instructed to do so (according to the currently viewed code). Why would this be any different with a different CA? [ASP.NET](http://ASP.NET) would still be a #@\*(+&#@ piece of software. ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [December 30, 2021, 1:22pm UTC](https://community.letsencrypt.org/t/still-getting-r3-certificates/168589/23 "2021-12-30T13:22:24Z")
I asked for a "workaround " not a "fix". It seems `ASP.NET` brings all the same related `Windows` cert problems with it. Perhaps searching the forum for help on `Windows` and `R3` might shed some light. ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [December 30, 2021, 3:06pm UTC](https://community.letsencrypt.org/t/still-getting-r3-certificates/168589/24 "2021-12-30T15:06:51Z")
> [@rg305](#): > > It seems `ASP.NET` brings all the same related `Windows` cert problems with it. Maybe. But, when I read the Kestrel developer threads about this they knew they only sent a leaf and even developed a fix to send a chain. But, it has not been deployed. It seems different than what IIS does in that regard. I did not read the Kestrel code - just the dev talk. ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [December 30, 2021, 3:25pm UTC](https://community.letsencrypt.org/t/still-getting-r3-certificates/168589/25 "2021-12-30T15:25:35Z")
> [@MikeMcQ](#): > > But, when I read the Kestrel developer threads about this they knew they only sent a leaf and even developed a fix to send a chain. But, it has not been deployed. Howcome, in this case, the already expired R3-signed-by-DST Root CA X3 is being send? If Kestrel doesn't send intermediates? 🤔 ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [December 30, 2021, 3:30pm UTC](https://community.letsencrypt.org/t/still-getting-r3-certificates/168589/26 "2021-12-30T15:30:36Z")
Ah. My bad. I was thinking an old client was building a faulty chain from the leaf but you made me remember I saw that faulty chain using openssl. So, agree. Probably [asp.net](http://asp.net) is interfering too. ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [January 29, 2022, 3:31pm UTC](https://community.letsencrypt.org/t/still-getting-r3-certificates/168589/27 "2022-01-29T15:31:18Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed. [Previous page](https://community.letsencrypt.org/t/still-getting-r3-certificates/168589.md?page=1)