search

afosto / yaac

Yet another ACME client: a decoupled LetsEncrypt client
Other
219 stars 85 forks source link

Add `Preferred Chain` option #32

Closed 0x4r45h closed 3 years ago

0x4r45h commented 3 years ago

LetsEncrypt is going to change their root certificates from "DST Root X3" to "ISRG’s" which is not working on android devices older than version 7.1.
they introduced a workaround for site owners to buy more time (~ 1 more year) before completely discarding "DST Root X3".
the get-certificate end point have an alternate link in its header response to let users pick their preferred-chain in certificate. Certbot implemented that already.
in this PR user is able to pass preferred chain as option preferred_chain during client initialization, if a cert matching that chain is found then it will be returned, otherwise the default certificate provided by Lets'Encrypt will be used

bakkerpeter commented 3 years ago

I don't think we should into this direction and add this feature. The client is to be lightweight and simple. To work around this issue of backwards compatibility I think there are many other solutions available. Thanks for your efforts.