Closed 0x4r45h closed 3 years ago
I don't think we should into this direction and add this feature. The client is to be lightweight and simple. To work around this issue of backwards compatibility I think there are many other solutions available. Thanks for your efforts.
LetsEncrypt is going to change their root certificates from "DST Root X3" to "ISRG’s" which is not working on android devices older than version 7.1.
they introduced a workaround for site owners to buy more time (~ 1 more year) before completely discarding "DST Root X3".
the get-certificate end point have an alternate link in its header response to let users pick their preferred-chain in certificate. Certbot implemented that already.
in this PR user is able to pass preferred chain as option
preferred_chain
during client initialization, if a cert matching that chain is found then it will be returned, otherwise the default certificate provided by Lets'Encrypt will be used