Hello, all Certificates I renewed today (about 9AM CEST) have a Revoked Certificate in Chain (Root YR) [image] Am I doing something wrong or do I missed something (e.g. do I have to use a special profile after the Change in the API yesterday)? I reverted the Certifcates on the server, so they w…

Hello @MikeMcQ , many thanks for the Help so far, I think I found our Problem. I debugged it today with the Domain " www.primus-truber.de ". We use the helios-ag/leclient PHP-Library to issue / renew Certificates centrally on our intranet and then distribute them to the diffrent Webservers. The Cer…

[image] 2026.05.08 Gen Y Cross-Certified Subordinate CAs missing serverAuth EKU Incidents W… We are revoking and reissuing our cross-signs of X2/YR by X1, and YE by X2. You are not serving the correct certificate chain, 2nd intermediate is missing - see…

Do you have a specific chain set up perhaps? I just forcibly renewed a certificate of mine and it came with the following cross-signed "Root YR" in its chain, just after the "YR1" intermediate signed by "Root YR": Certificate: Data: Version: 3 (0x2) Serial Number: f…

Hi guys, I have the same problem; the certificate chain gives me the same error as in the screenshot. My issue is that I can't manipulate the certificate because I'm using it in a WAF to secure a website. The WAF automatically presents the certificate due to an integration between Let's Encrypt and…

Hello, many thanks all for your help so far. it seems, that Let's Encrypt API sends only 2 of the 3 Intermediate Certificates, I solved the Issue for me with downloading the missing Certificate and appending it to the chain, so only the root needs to be in the trust store. I don't know, how this …

I just got a test certificate and the LE API correctly returns the YR signed by X1 certificate: le-rsa-2026-05-29 · GitHub Maybe there's a bug/misconfiguration in your ACME client? Perhaps it picked the shorter/alternative chain, which isn't going to work well since the YR certificate on its own is…

[image] frank.roeske: it seems, that Let's Encrypt API sends only 2 of the 3 Intermediate Certificates I don't see that happening. I posted this on another thread earlier today. I get the leaf and 3 intermediates from both Staging and Production: The sandbox API includes different chain tha…

hi guys, It may already be resolved. I reissued a certificate, and it was renewed as type YR1. I scanned the site, and now the certificate chain appears to be correct, and the certificate is trusted. regards

[image] cgl: hi guys, It may already be resolved Well, whatever your problem was is resolved. But, while your symptom may have been the same as @frank.roeske the cause was likely different. If you continue to have problems please start a new thread so we can deal with the specifics of your…

[image] MikeMcQ: Would you explain which ACME Client you are using and its version? In fact, the more info we have from the form you would have been shown the easier it is to help. @frank.roeske I see your system is now sending the correct chain for your RSA cert. And, I hope you found the u…

YE/YR are not in ca-certificates! % dpkg -L ca-certificates | grep ISRG /usr/share/ca-certificates/mozilla/ISRG_Root_X1.crt /usr/share/ca-certificates/mozilla/ISRG_Root_X2.crt Chains of Trust - Let's Encrypt says: These roots are not yet included in Root Program Trust Stores, but will be submitt…

Today (re)issued Certificates from Issuer YR2 have a Revoked Cert in Chain

Help

Topic		Replies	Views
Chain validation issues with YE/YR under Linux distributions Help	10	652	June 10, 2026
R3 Intermediate certificate has expired Help	133	36961	November 1, 2021
Cert is unsigned - Fullchain issues Help	11	3446	July 20, 2021
How will clients handle X2 by X1 cross certificate revocation Issuance Tech	19	367	May 14, 2026
Questions re: Beginning Issuance from R3 Issuance Tech	61	9907	January 21, 2021

Today (re)issued Certificates from Issuer YR2 have a Revoked Cert in Chain

Related topics