Let's Encrypt's new “Generation Y” root certificate, which has been included in the default profile since May 13, 2026, is not yet present in any Windows certificate store.
Let's Encrypt resolves this using a cross-signature: ISRG Root YE is additionally signed by the old ISRG Root X1. To ensure the chain reaches clients, the server must send two intermediate certificates.
In my view, a solution that retrieves all certificates from chain.pem generally makes sense and has no drawbacks. I've implemented a solution on our relay server and could contribute it here if desired.
Let's Encrypt's new “Generation Y” root certificate, which has been included in the default profile since May 13, 2026, is not yet present in any Windows certificate store.
Let's Encrypt resolves this using a cross-signature: ISRG Root YE is additionally signed by the old ISRG Root X1. To ensure the chain reaches clients, the server must send two intermediate certificates.
In my view, a solution that retrieves all certificates from
chain.pemgenerally makes sense and has no drawbacks. I've implemented a solution on our relay server and could contribute it here if desired.