# Why do Letsencrypt still add the expired root cert?

**URL:** <https://community.letsencrypt.org/t/why-do-letsencrypt-still-add-the-expired-root-cert/166676>\
**Category:** Issuance Tech\
**Created:** [November 30, 2021, 4:48pm UTC](https://community.letsencrypt.org/t/why-do-letsencrypt-still-add-the-expired-root-cert/166676 "2021-11-30T16:48:24Z")\
**Posts on this page:** 1\
**Showing post:** 7

<div class="post-metadata">

**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\
**Post date:** [November 30, 2021, 8:55pm UTC](https://community.letsencrypt.org/t/why-do-letsencrypt-still-add-the-expired-root-cert/166676/7 "2021-11-30T20:55:10Z")

</div>

> [@rg305](#):
>
> @Osiris I tend to disagree here; it requires more than just thinking.  
> You would have to at least know which certs to pick from.

From the certbot documentation for `--preferred-chain`:

> prefer the chain whose topmost certificate was issued from this Subject Common Name.

From [Providing a longer certificate chain by default](https://community.letsencrypt.org/t/providing-a-longer-certificate-chain-by-default/148738) also linked above:

> This chain will consist of three certificates, instead of the current two:
> 
> - End-entity certificate (aka leaf certificate), signed by R3
> - R3, signed by ISRG Root X1
> - ISRG Root X1, signed by **DST Root CA X3**
> 
> Our API will also offer an "alternate" chain, which you may configure your ACME client to select instead:
> 
> - End-entity certificate, signed by R3
> - R3, signed by **ISRG Root X1**

The possible values for the `--preferred-chain` clearly indicated by the "signed by" followed by the required common name.

Although perhaps some explanation about what a Common Name actually is might be helpful, it's not rocket science.

---

_[View the full topic](https://community.letsencrypt.org/t/why-do-letsencrypt-still-add-the-expired-root-cert/166676)._