YE/YR are not in ca-certificates!
% dpkg -L ca-certificates | grep ISRG
/usr/share/ca-certificates/mozilla/ISRG_Root_X1.crt
/usr/share/ca-certificates/mozilla/ISRG_Root_X2.crt
Chains of Trust - Let's Encrypt says:
These roots are not yet included in Root Program Trust Stores, but will be submitted for inclusion soon:
ISRG Root YE / ISRG Root YR, both were issued more than a half year ago!