Will a renewed LEA-X3 SSL certificate be recognised as issued by ISRG-X1 on July 8, 2020?

Hi @pmdscully, welcome to the forum. FYI, I have edited your post where it said “XSRG-X1” to say “ISRG-X1” to avoid confusion.

Also, we’ve just announced a change in the transition time to ISRG Root X1. It will now be September 29 2020: Transition to ISRG's Root delayed until Sep 29

Can I ask a followup question: What is the API you are planning to integrate with? Is it a webhook style API? Or something else? That will affect our answers about how it works. Also, what web server are you using?

As a brief intro: When you get a certificate from Let’s Encrypt, it will be issued by “Let’s Encrypt Authority X3.” There are two certificates with that Subject, one signed by ISRG Root X1 and one signed by DST Root X3. When you configure your web server, you can choose whichever of those certificates you want, depending on your needs. For your needs, it sounds like you should configure the one that’s signed by ISRG Root X1. It should go in the certificate “chain” (see your web server’s documentation for details). Note that your ACME client, as of right now, will autoconfigure the DST Root X3-signed version as your chain, so you will need to do a small amount of manual configuration.

3 Likes