Skip to content

acme: add preferred_chain option

Charles Decoux requested to merge add-preferred-chain into master

Let's Encrypt currently (cross)signs its certificates with both ISRG Root X1 and DST Root CA X3: https://community.letsencrypt.org/t/production-chain-changes/150739

This breaks on DoH/DoT servers used as Android Private DNS because Android excepts each single CA which signed/crosssigned the certificate to be valid, instead if it already met a well-known valid one during the bottom-up validation.

This MR adds the ability to configure a custom preferred chain globally or for each certificate.

Merge request reports