Preferred chain: LetsEncrypt Subscriber Certificate < – R3 < – ISRG Root X1

[heffergm]

As relates to https://letsencrypt.org/2020/12/21/extending-android-compatibility.html, it sounds like there is presently no way to select the alternate chain LE is going to offer (Subscriber Certificate < – R3 < – ISRG Root X1). Is this something that's in the works?

[lukas2511]

This is already supported in the newest version.

Either as CLI argument:

--preferred-chain issuer-cn Use alternative certificate chain identified by issuer CN

Or via a config parameter:

# Preferred issuer chain (default: <unset> -> uses default chain)
#PREFERRED_CHAIN=

[heffergm]

So, the question arose due to this note from LetsEncrypt:

What about the alternate chain? Today, some ACME clients are able to instead request an alternate chain, if their user has 
configured it. We currently provide the option of getting the chain: Subscriber Certificate < – R3 < – ISRG Root X1 We will 
continue to offer this same chain as an alternate. However, note that most ACME clients don’t yet have a way to select this 
alternate chain (for example, Certbot selects chains by looking to see if they contain a given Issuer Name, but this chain 
doesn’t contain any Issuer Names which the high compatibility chain above doesn’t). We’ll be working with ACME client 
developers to create more flexible chain selection mechanisms going forward.

Specifically, the note about "no acme clients having a way to select this alternate chain...". If the existing preferred-chain option in dehydrated doesn't suffer this issue, that's great.

[lukas2511]

My current implementation just travels up the trust chain until it gets to the uppermost issuer certificate, which in this case should be DST Root CA X3 by default, or ISRG Root X1 as alternative, and those names should be selectable by the mentioned parameters.

[...] available options: DST Root CA X3, ISRG Root X1

[mckaygerhard]

Specifically, the note about "no acme clients having a way to select this alternate chain...". If the existing preferred-chain option in dehydrated doesn't suffer this issue, that's great.

it seems that is the case, cos i checked my cert at the browsers and still shows R3 as issuer.. check #892 or i dont know how is the workflow of those mechanish?

configured it. We currently provide the option of getting the chain: Subscriber Certificate < – R3 < – ISRG Root X1 We will continue to offer this same chain as an alternate. However, note that most ACME clients don’t yet have a way to select this alternate chain (for example, Certbot selects chains by looking to see if they contain a given Issuer Name, but this chain doesn’t contain any Issuer Names which the high compatibility chain above doesn’t). We’ll be working with ACME client developers to create more flexible chain selection mechanisms going forward.