What is the chain to pass to --preferred-chain argument to keep using DST Root X3 root certificate?

[jillian]

I don't want this edit burried in the long reply.

@jillian

Unfortunately this is a lot of manual, “remember this” work but once you finish testing it can be automated until ‘DST Root CA X3’ expires in September 2021. (edit: the cutover will be earlier see this post)

The reasoning is captured in the first foot note:

@_az

[1]. Although the Identrust cross-sign will expire on September 29 2021, the Let's Encrypt ACME server will stop offering the Identrust certificate chain around 90 days before that date. This is to ensure that all installed certificate chains are valid for the full 90 day lifetime of a Let's Encrypt certificate.