7月8日の生成分からLet's Encryptの中間証明書がLet's EncryptのRoot CA (ISRG Root X1)のみに伝搬？接続？依存？するようになるそうです。ISRG Root X1を知らないクライアントは証明書を信用できなくなっちゃうけど古い子だけだろうって。
letsencrypt.orgChain of Trust - Let's EncryptRoot Certificates Our roots are kept safely offline. We issue end-entity certificates to subscribers from the intermediates in the next section. For additional compatibility as we submit our new Root X2 to various root programs, we have also cross-signed it from Root X1.
Active ISRG Root X1 (RSA 4096, O = Internet Security Research Group, CN = ISRG Root X1) Self-signed: der, pem, txt Cross-signed by DST Root CA X3: der, pem, txt Active, limited availability ISRG Root X2 (ECDSA P-384, O = Internet Security Research Group, CN = ISRG Root X2) Self-signed: der, pem, txt Cross-signed by ISRG Root X1: der, pem, txt We’ve set up websites to test certificates chaining to our active roots.