I need to keep using the current cross signed certificate chain as long as possible. certbot's help says: "[...] prefer the chain with an issuer matching this Subject Common Name". Will this do the trick ?: certbot renew --preferred-chain "DST Root CA X3" How can I check that this is working bef…

[image] fzo: I was looking for a way (a specific log entry or something on stdout) to check that the chain argument is correct and that "DST Root CA X3" is not used as fallback If you want to check that the Certbot flag works as expected, one option is to spin up a small testing environment a…

See: Certbot 1.6.0 Release [image]

[image] fzo: How can I check that this is working before January 11, 2021 ? Try issuing a new cert in --staging. Sorry: Staging can't replicate the change to the trusted chain.

[image] rg305: Try issuing a new cert in --staging . I haven't tried this yet I must admit, but wouldn't the chain names be different in staging since that uses fake certificates?

They would. Unfortunately, I can't find the names of the new chain for the staging server

The secondary chain on staging currently rolls up to the root called Fake LE Root X2.

Makes sense @rmbolger , thanks :stuck_out_tongue: Perhaps an idea to add it to the staging environment documentation.

You can also put the option into cli.ini so that you don't have to remember to pass the flag every time.

But will that lead to confusion/lack of support when --staging certs are being requested? RE: @petercooperjr question: [image] petercooperjr: wouldn't the chain names be different in staging since that uses fake certificates? There is no cli-staging.ini

The flag is only a hint to Certbot, not a requirement. So when you request a certificate from the staging server and Certbot can't find a matching alternate chain, Certbot will just use the default chain that was sent. The alternate chain from staging is only really useful as a tool for client dev…

@rg305 certbot will ignore the value of preferred-chain when it can't find the value in the alternate chains. I'm pretty sure that if someone wants to experiment with different chains on the staging server, they'll use the command line option --preferred-chain. Although I'm not certain if the comma…

What is the chain to pass to --preferred-chain argument to keep using DST Root X3 root certificate?

Help

rg305 November 9, 2020, 11:09am 2

See: Certbot 1.6.0 Release

Topic		Replies	Views
--preferred-chain not taking effect Help	35	10727	November 17, 2021
Certbot has been configured to prefer certificate chains with issuer 'ISRG Root X1', but no chain from the CA matched this issuer. Using the default certificate chain instead Help	20	4733	January 9, 2022
Is the preferred-chain 'DST X3 Chain' option live? Help	4	2160	December 21, 2020
Shortening the Let's Encrypt Chain of Trust Help	10	1039	February 14, 2024
Issue certificate using the IdentTrust « old chain » Help	16	2611	May 18, 2021

What is the chain to pass to --preferred-chain argument to keep using DST Root X3 root certificate?

Related topics