Can't choose the ISRG root CA?

[stephanromano]

Is there a way I can specify the receipt of the ISRG Root X1 CA, instead of the cross-signed DST Root CA X3?

I tried configuring Acmebot:PreferredChain to ISRG Root X1 but I still receive the DST Root CA X3 CA when I download the issued certificate. Similarly, I can't call their ISRG Root X2 EC root CA by modifying this value.

[shibayan]

I have confirmed that ISRG Root X1 can issue root certificates by adding this setting. Acmebot:PreferredChain = ISRG Root X1

If the PFX downloaded from the Key Vault contains two certificates, they are short-chain, i.e. ISRG Root X1 is the root. ISRG Root X2 is of limited use and is not available to the public at this time

[stephanromano]

I have confirmed that ISRG Root X1 can issue root certificates by adding this setting. Acmebot:PreferredChain = ISRG Root X1

If the PFX downloaded from the Key Vault contains two certificates, they are short-chain, i.e. ISRG Root X1 is the root. ISRG Root X2 is of limited use and is not available to the public at this time

I know the X2 isn't really production-ready yet, but it was an attempt to determine if my config value was having any effect.

I think the issue might be that the cross-signed root and the self-signed root have the same name. What I'm trying to do is get the self-signed root as part of the chain.

Is it possible to get the self-signed root included in the chain instead of the DST Root CA X3 cross-signed root?

[shibayan]

It is not possible to include an ISRG Root X1 root certificate because the Let's Encrypt API does not return a certificate containing a self-signed root certificate.

[stephanromano]

Thanks for the response.