Transition from X3 to R3 Intermediate

Issuance Tech
#1

I understand that on January 11th Let's Encrypt will change the default Intermediate to E1 which is no longer signed by Identrust. This will be a big deal for many people, but I understand that the R3 Intermediate will still be an option (via --preferred-chain on certbot) for those of us requiring this backwards compatibility a bit longer.

I'm looking for clarification on the transition (happening within a week or so?) switching from X3 to R3. The latter is still signed by both Identrust and ISRG so in theory it has the same backwards compatibility. What I do not understand is which of those two trust chains will be used by default and end up in our fullchain.pem. For most modern browsers it doesn't matter too much, as the browser will be able to follow either chain by requesting additional intermediates as required. However for embedded devices that don't support AIA (Authority Information Access) this is not necessarily the case. Only the chain that our servers supply in fullchain.pem is viable.

It's not clear to me whether this will be determined by Let's Encrypt or by the issuance client (certbot, etc.). If it makes a difference, I am using simp_le via docker-letsencrypt-nginx-proxy-companion.

3 Likes
#2

We don't have a firm date set yet, but it will be this fall. We're currently waiting on a cross-sign from IdenTrust on the R3 and R4 intermediates.

Until the January 11th switchover, our ACME service will be instructing clients to serve the X3 -> DST Root X3 or R3 -> DST Root X3 chain (that's what will wind up in your fullchain.pem).

Let's Encrypt offers a default chain via the ACME protocol, and clients generally use that. We very recently rolled out an "alternate chain" feature that offers clients a secondary chain and lets them choose. For instance, right now our "alternate chain" is the one rooted in ISRG Root X1.

5 Likes
Force X4 root in chain before it becomes default
#3

That's everything I wanted to know. Thanks so much!

5 Likes
#4

Maybe it's discussed somewhere else, but this looks as appropriate place...
Will you let us know when you switch from X3 to R3? Because at the moment I statically distributing X3 to our certificate storage with every certificate and have to switch it to R3.

1 Like
#5

You may see it here and elsewhere on the forum, but the most reliable place to get updates about Let's Encrypt service changes is by subscribing to the API Announcements category.

https://community.letsencrypt.org/c/api-announcements/18

(when you do this, you can get e-mail notifications from the forum about new posts, which are relatively infrequent)

2 Likes