[image] Chains of Trust - Let's Encrypt Note: This section describes Let’s Encrypt’s hierarchy as of June 6, 2024. For the hierarchy in use prior to June 6, see below. This page describes all of the current and relevant historical Certification Authorities operated by... …

I think it was an intentional choice, to describe "validity" (how long they expect it to be around for) rather than "notAfter" (what the self-signed cert says). I remember there being a (very) brief mention of it when they were asking for feedback on would became those pages, but I can't find it at …

The certificates page contains a paragraph that explains this discrepancy: Note that Root CAs don’t have expiration dates in quite the same way that other certificates do. Although their self-signed certificates do contain a notAfter date, Root Programs and Trust Stores may decide to trust a Root …

Yeah! That's what I had read somewhere. Thanks for digging it up. :slight_smile:

Note that I was concerned because this mismatch meant in my eyes that I was looking at the wrong cert in the browser. May be worth clarifying "Intended to be used until", etc. FWIW, I got some code that may need verification when the root CA is changed. That means that knowing when this is actuall…

[image] ayende: I was concerned because this mismatch meant in my eyes that I was looking at the wrong cert in the browser. I could also see it being useful to list both. I know I've confirmed what certificates I'm looking at by comparing cert expiration dates in the past as well. [image] …

[image] ayende: I got some code that may need verification when the root CA is changed If your code need to know when specific roots expire that suggests your system has a potentially brittle dependency that carries some risk (ask me how I know!). You should be able to change CA (with a compl…

My concern is how we'll handle switch over of the root CA when that happens. It is an issue about automating "this is the same cert" when the cert is changed very 3 months. So we rely on the chain still having the same root, but we need to know how that will change over time when it expires. And …

It sounds like you are implementing your own path validation for the certificate chain, presumably against your own trust store, is that right?

Somewhat, yes. We do client certificate auth, but we need to ensure that we keep track of the certificate as they change if they represent the same entity. We do that using the same key + chain, basically.

[image] ayende: We do client certificate auth Let's Encrypt certificates are not really suitable for use as client certificates. [image] Can I create client certificates for a received LetsEncrypt certificate? Help C…

Wrong dates in Chain of Trust Page

Site Feedback

linkp May 22, 2024, 8:31pm 11

Let's Encrypt certificates are not really suitable for use as client certificates.

Topic		Replies	Views
Chain has the wrong root certificate (update: no it doesn't) Help	3	547	September 14, 2023
IdenTrust DST Root CA X3 expiry Help	17	5547	October 7, 2021
ISRG Root X1 expiring... Please confirm the latest cert Help	10	1691	September 17, 2024
Possible expired ISRG Root X2 cert included in chain starting ~May28th? Help	7	473	June 2, 2026
Provide a valid certificate chain Help	8	1455	February 28, 2023

Wrong dates in Chain of Trust Page

Related topics