Transition from X3 to R3 Intermediate

[jsha]

@lukecyca

I'm looking for clarification on the transition (happening within a week or so?) switching from X3 to R3.

We don't have a firm date set yet, but it will be this fall. We're currently waiting on a cross-sign from IdenTrust on the R3 and R4 intermediates.

@lukecyca

What I do not understand is which of those two trust chains will be used by default and end up in our fullchain.pem .

Until the January 11th switchover, our ACME service will be instructing clients to serve the X3 -> DST Root X3 or R3 -> DST Root X3 chain (that's what will wind up in your fullchain.pem).

@lukecyca

It's not clear to me whether this will be determined by Let's Encrypt or by the issuance client (certbot, etc.). If it makes a difference, I am using simp_le via docker-letsencrypt-nginx-proxy-companion.

Let's Encrypt offers a default chain via the ACME protocol, and clients generally use that. We very recently rolled out an "alternate chain" feature that offers clients a secondary chain and lets them choose. For instance, right now our "alternate chain" is the one rooted in ISRG Root X1.