Skip to content

Only the first certificate from the chain file is sent — breaks Let's Encrypt Generation Y #4

Description

@EH-BFW

Let's Encrypt's new “Generation Y” root certificate, which has been included in the default profile since May 13, 2026, is not yet present in any Windows certificate store.

Let's Encrypt resolves this using a cross-signature: ISRG Root YE is additionally signed by the old ISRG Root X1. To ensure the chain reaches clients, the server must send two intermediate certificates.

In my view, a solution that retrieves all certificates from chain.pem generally makes sense and has no drawbacks. I've implemented a solution on our relay server and could contribute it here if desired.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions