22title : Chains of Trust
33linkTitle : Chains of Trust (Root and Intermediate Certificates)
44slug : certificates
5- lastmod : 2025-09-25
5+ lastmod : 2025-10-06
66show_lastmod : 1
77---
88
@@ -31,7 +31,7 @@ Note that Root CAs don't have expiration dates in quite the same way that other
3131 * CA details: [ crt.sh] ( https://crt.sh/?caid=183269 ) , [ issued certs] ( https://crt.sh/?Identity=%25&iCAID=183269 )
3232 * Certificate details (self-signed): [ crt.sh] ( https://crt.sh/?id=3335562555 ) , [ der] ( /certs/isrg-root-x2.der ) , [ pem] ( /certs/isrg-root-x2.pem ) , [ txt] ( /certs/isrg-root-x2.txt )
3333 * Certificate details (cross-signed by ISRG Root X1): [ crt.sh] ( https://crt.sh/?id=3334561878 ) , [ der] ( /certs/isrg-root-x2-cross-signed.der ) , [ pem] ( /certs/isrg-root-x2-cross-signed.pem ) , [ txt] ( /certs/isrg-root-x2-cross-signed.txt )
34- * Certificate details (second cross-sign by ISRG Root X1): [ der] ( /certs/gen-y/root-x2-by-x1.der ) , [ pem] ( /certs/gen-y/root-x2-by-x1.pem ) , [ txt] ( /certs/gen-y/root-x2-by-x1.txt )
34+ * Certificate details (second cross-sign by ISRG Root X1): [ crt.sh ] ( https://crt.sh/?id=20878422868 ) , [ der] ( /certs/gen-y/root-x2-by-x1.der ) , [ pem] ( /certs/gen-y/root-x2-by-x1.pem ) , [ txt] ( /certs/gen-y/root-x2-by-x1.txt )
3535 * Test websites: [ valid] ( https://valid-isrgrootx2.letsencrypt.org/ ) , [ revoked] ( https://revoked-isrgrootx2.letsencrypt.org/ ) , [ expired] ( https://expired-isrgrootx2.letsencrypt.org/ )
3636
3737These roots are not yet included in Root Program Trust Stores, but will be submitted for inclusion soon:
@@ -40,13 +40,15 @@ These roots are not yet included in Root Program Trust Stores, but will be submi
4040 * Subject: ` O = ISRG, CN = Root YE `
4141 * Key type: ` ECDSA P-384 `
4242 * Trusted until: N/A (generated 2025-09-03)
43+ * CA details: [ crt.sh] ( https://crt.sh/?caid=430535 ) , [ issued certs] ( https://crt.sh/?Identity=%25&iCAID=430535 )
4344 * Certificate details (self-signed): [ der] ( /certs/gen-y/root-ye.der ) , [ pem] ( /certs/gen-y/root-ye.pem ) , [ txt] ( /certs/gen-y/root-ye.txt )
4445 * Certificate details (cross-signed by ISRG Root X2): [ der] ( /certs/gen-y/root-ye-by-x2.der ) , [ pem] ( /certs/gen-y/root-ye-by-x2.pem ) , [ txt] ( /certs/gen-y/root-ye-by-x2.txt )
4546 * Test websites: Forthcoming
4647* ** ISRG Root YR**
4748 * Subject: ` O = ISRG, CN = Root YR `
4849 * Key type: ` RSA 4096 `
4950 * Trusted until: N/A (generated 2025-09-03)
51+ * CA details: [ crt.sh] ( https://crt.sh/?caid=430543 ) , [ issued certs] ( https://crt.sh/?Identity=%25&iCAID=430543 )
5052 * Certificate details (self-signed): [ der] ( /certs/gen-y/root-yr.der ) , [ pem] ( /certs/gen-y/root-yr.pem ) , [ txt] ( /certs/gen-y/root-yr.txt )
5153 * Certificate details (cross-signed by ISRG Root X1): [ der] ( /certs/gen-y/root-yr-by-x1.der ) , [ pem] ( /certs/gen-y/root-yr-by-x1.pem ) , [ txt] ( /certs/gen-y/root-yr-by-x1.txt )
5254 * Test websites: Forthcoming
@@ -64,27 +66,27 @@ All intermediate certificate Subjects have a Country field of `C = US`.
6466 * Key type: ` ECDSA P-384 `
6567 * Valid until: 2027-03-12
6668 * CA details: [ crt.sh] ( https://crt.sh/?caid=295813 ) , [ issued certs] ( https://crt.sh/?Identity=%25&iCAID=295813 )
67- * Certificate details (signed by ISRG Root X2): [ der] ( /certs/2024/e7.der ) , [ pem] ( /certs/2024/e7.pem ) , [ txt] ( /certs/2024/e7.txt )
68- * Certificate details (cross-signed by ISRG Root X1): [ der] ( /certs/2024/e7-cross.der ) , [ pem] ( /certs/2024/e7-cross.pem ) , [ txt] ( /certs/2024/e7-cross.txt )
69+ * Certificate details (signed by ISRG Root X2): [ crt.sh ] ( https://crt.sh/?id=12396132900 ) , [ der] ( /certs/2024/e7.der ) , [ pem] ( /certs/2024/e7.pem ) , [ txt] ( /certs/2024/e7.txt )
70+ * Certificate details (cross-signed by ISRG Root X1): [ crt.sh ] ( https://crt.sh/?id=12396132895 ) , [ der] ( /certs/2024/e7-cross.der ) , [ pem] ( /certs/2024/e7-cross.pem ) , [ txt] ( /certs/2024/e7-cross.txt )
6971* ** Let's Encrypt E8**
7072 * Subject: ` O = Let's Encrypt, CN = E8 `
7173 * Key type: ` ECDSA P-384 `
7274 * Valid until: 2027-03-12
7375 * CA details: [ crt.sh] ( https://crt.sh/?caid=295809 ) , [ issued certs] ( https://crt.sh/?Identity=%25&iCAID=295809 )
74- * Certificate details (signed by ISRG Root X2): [ der] ( /certs/2024/e8.der ) , [ pem] ( /certs/2024/e8.pem ) , [ txt] ( /certs/2024/e8.txt )
75- * Certificate details (cross-signed by ISRG Root X1): [ der] ( /certs/2024/e8-cross.der ) , [ pem] ( /certs/2024/e8-cross.pem ) , [ txt] ( /certs/2024/e8-cross.txt )
76+ * Certificate details (signed by ISRG Root X2): [ crt.sh ] ( https://crt.sh/?id=12396132890 ) , [ der] ( /certs/2024/e8.der ) , [ pem] ( /certs/2024/e8.pem ) , [ txt] ( /certs/2024/e8.txt )
77+ * Certificate details (cross-signed by ISRG Root X1): [ crt.sh ] ( https://crt.sh/?id=12396132901 ) , [ der] ( /certs/2024/e8-cross.der ) , [ pem] ( /certs/2024/e8-cross.pem ) , [ txt] ( /certs/2024/e8-cross.txt )
7678* ** Let's Encrypt R12**
7779 * Subject: ` O = Let's Encrypt, CN = R12 `
7880 * Key type: ` RSA 2048 `
7981 * Valid until: 2027-03-12
8082 * CA details: [ crt.sh] ( https://crt.sh/?caid=295816 ) , [ issued certs] ( https://crt.sh/?Identity=%25&iCAID=295816 )
81- * Certificate details (signed by ISRG Root X1): [ der] ( /certs/2024/r12.der ) , [ pem] ( /certs/2024/r12.pem ) , [ txt] ( /certs/2024/r12.txt )
83+ * Certificate details (signed by ISRG Root X1): [ crt.sh ] ( https://crt.sh/?id=12396132898 ) , [ der] ( /certs/2024/r12.der ) , [ pem] ( /certs/2024/r12.pem ) , [ txt] ( /certs/2024/r12.txt )
8284* ** Let's Encrypt R13**
8385 * Subject: ` O = Let's Encrypt, CN = R13 `
8486 * Key type: ` RSA 2048 `
8587 * Valid until: 2027-03-12
8688 * CA details: [ crt.sh] ( https://crt.sh/?caid=295817 ) , [ issued certs] ( https://crt.sh/?Identity=%25&iCAID=295817 )
87- * Certificate details (signed by ISRG Root X1): [ der] ( /certs/2024/r13.der ) , [ pem] ( /certs/2024/r13.pem ) , [ txt] ( /certs/2024/r13.txt )
89+ * Certificate details (signed by ISRG Root X1): [ crt.sh ] ( https://crt.sh/?id=12396132902 ) , [ der] ( /certs/2024/r13.der ) , [ pem] ( /certs/2024/r13.pem ) , [ txt] ( /certs/2024/r13.txt )
8890
8991Click below for details on additional intermediates which are not part of the active issuance hierarchy:
9092
@@ -98,14 +100,14 @@ These intermediate CAs have currently-valid certificates, but are not being issu
98100 * Key type: ` ECDSA P-384 `
99101 * Valid until: 2027-03-12
100102 * CA details: [ crt.sh] ( https://crt.sh/?caid=295812 ) , [ issued certs] ( https://crt.sh/?Identity=%25&iCAID=295812 )
101- * Certificate details (signed by ISRG Root X2): [ der] ( /certs/2024/e9.der ) , [ pem] ( /certs/2024/e9.pem ) , [ txt] ( /certs/2024/e9.txt )
102- * Certificate details (cross-signed by ISRG Root X1): [ der] ( /certs/2024/e9-cross.der ) , [ pem] ( /certs/2024/e9-cross.pem ) , [ txt] ( /certs/2024/e9-cross.txt )
103+ * Certificate details (signed by ISRG Root X2): [ crt.sh ] ( https://crt.sh/?id=12396132894 ) , [ der] ( /certs/2024/e9.der ) , [ pem] ( /certs/2024/e9.pem ) , [ txt] ( /certs/2024/e9.txt )
104+ * Certificate details (cross-signed by ISRG Root X1): [ crt.sh ] ( https://crt.sh/?id=12396132894 ) , [ der] ( /certs/2024/e9-cross.der ) , [ pem] ( /certs/2024/e9-cross.pem ) , [ txt] ( /certs/2024/e9-cross.txt )
103105* ** Let's Encrypt R14**
104106 * Subject: ` O = Let's Encrypt, CN = R14 `
105107 * Key type: ` RSA 2048 `
106108 * Valid until: 2027-03-12
107109 * CA details: [ crt.sh] ( https://crt.sh/?caid=295818 ) , [ issued certs] ( https://crt.sh/?Identity=%25&iCAID=295818 )
108- * Certificate details (signed by ISRG Root X1): [ der] ( /certs/2024/r14.der ) , [ pem] ( /certs/2024/r14.pem ) , [ txt] ( /certs/2024/r14.txt )
110+ * Certificate details (signed by ISRG Root X1): [ crt.sh ] ( https://crt.sh/?id=12396132903 ) , [ der] ( /certs/2024/r14.der ) , [ pem] ( /certs/2024/r14.pem ) , [ txt] ( /certs/2024/r14.txt )
109111
110112</details >
111113
@@ -118,31 +120,37 @@ These intermediate CAs were issued in 2025, and we expect to begin issuing from
118120 * Subject: ` O = Let's Encrypt, CN = YE1 `
119121 * Key type: ` ECDSA P-384 `
120122 * Valid until: 2028-09-02
123+ * CA details: [ crt.sh] ( https://crt.sh/?caid=432952 ) , [ issued certs] ( https://crt.sh/?Identity=%25&iCAID=432952 )
121124 * Certificate details: [ der] ( /certs/gen-y/int-ye1.der ) , [ pem] ( /certs/gen-y/int-ye1.pem ) , [ txt] ( /certs/gen-y/int-ye1.txt )
122125* ** Let's Encrypt YE2**
123126 * Subject: ` O = Let's Encrypt, CN = YE2 `
124127 * Key type: ` ECDSA P-384 `
125128 * Valid until: 2028-09-02
129+ * CA details: [ crt.sh] ( https://crt.sh/?caid=431054 ) , [ issued certs] ( https://crt.sh/?Identity=%25&iCAID=431054 )
126130 * Certificate details: [ der] ( /certs/gen-y/int-ye2.der ) , [ pem] ( /certs/gen-y/int-ye2.pem ) , [ txt] ( /certs/gen-y/int-ye2.txt )
127131* ** Let's Encrypt YE3**
128132 * Subject: ` O = Let's Encrypt, CN = YE3 `
129133 * Key type: ` ECDSA P-384 `
130134 * Valid until: 2028-09-02
135+ * CA details: [ crt.sh] ( https://crt.sh/?caid=432914 ) , [ issued certs] ( https://crt.sh/?Identity=%25&iCAID=432914 )
131136 * Certificate details: [ der] ( /certs/gen-y/int-ye3.der ) , [ pem] ( /certs/gen-y/int-ye3.pem ) , [ txt] ( /certs/gen-y/int-ye3.txt )
132137* ** Let's Encrypt YR1**
133138 * Subject: ` O = Let's Encrypt, CN = YR1 `
134139 * Key type: ` RSA 2048 `
135140 * Valid until: 2028-09-02
141+ * CA details: [ crt.sh] ( https://crt.sh/?caid=432476 ) , [ issued certs] ( https://crt.sh/?Identity=%25&iCAID=432476 )
136142 * Certificate details: [ der] ( /certs/gen-y/int-yr1.der ) , [ pem] ( /certs/gen-y/int-yr1.pem ) , [ txt] ( /certs/gen-y/int-yr1.txt )
137143* ** Let's Encrypt YR2**
138144 * Subject: ` O = Let's Encrypt, CN = YR2 `
139145 * Key type: ` RSA 2048 `
140146 * Valid until: 2028-09-02
147+ * CA details: [ crt.sh] ( https://crt.sh/?caid=432477 ) , [ issued certs] ( https://crt.sh/?Identity=%25&iCAID=432477 )
141148 * Certificate details: [ der] ( /certs/gen-y/int-yr2.der ) , [ pem] ( /certs/gen-y/int-yr2.pem ) , [ txt] ( /certs/gen-y/int-yr2.txt )
142149* ** Let's Encrypt YR3**
143150 * Subject: ` O = Let's Encrypt, CN = YR3 `
144151 * Key type: ` RSA 2048 `
145152 * Valid until: 2028-09-02
153+ * CA details: [ crt.sh] ( https://crt.sh/?caid=432480 ) , [ issued certs] ( https://crt.sh/?Identity=%25&iCAID=432480 )
146154 * Certificate details: [ der] ( /certs/gen-y/int-yr3.der ) , [ pem] ( /certs/gen-y/int-yr3.pem ) , [ txt] ( /certs/gen-y/int-yr3.txt )
147155
148156</details >
@@ -169,15 +177,15 @@ These intermediate CAs are no longer being used to issue Subscriber certificates
169177 * Key type: ` ECDSA P-384 `
170178 * Valid until: 2027-03-12
171179 * CA details: [ crt.sh] ( https://crt.sh/?caid=295810 ) , [ issued certs] ( https://crt.sh/?Identity=%25&iCAID=295810 )
172- * Certificate details (signed by ISRG Root X2): [ der] ( /certs/2024/e5.der ) , [ pem] ( /certs/2024/e5.pem ) , [ txt] ( /certs/2024/e5.txt )
173- * Certificate details (cross-signed by ISRG Root X1): [ der] ( /certs/2024/e5-cross.der ) , [ pem] ( /certs/2024/e5-cross.pem ) , [ txt] ( /certs/2024/e5-cross.txt )
180+ * Certificate details (signed by ISRG Root X2): [ crt.sh ] ( https://crt.sh/?id=12396132891 ) , [ der] ( /certs/2024/e5.der ) , [ pem] ( /certs/2024/e5.pem ) , [ txt] ( /certs/2024/e5.txt )
181+ * Certificate details (cross-signed by ISRG Root X1): [ crt.sh ] ( https://crt.sh/?id=12396132892 ) , [ der] ( /certs/2024/e5-cross.der ) , [ pem] ( /certs/2024/e5-cross.pem ) , [ txt] ( /certs/2024/e5-cross.txt )
174182* ** Let's Encrypt E6**
175183 * Subject: ` O = Let's Encrypt, CN = E6 `
176184 * Key type: ` ECDSA P-384 `
177185 * Valid until: 2027-03-12
178186 * CA details: [ crt.sh] ( https://crt.sh/?caid=295819 ) , [ issued certs] ( https://crt.sh/?Identity=%25&iCAID=295819 )
179- * Certificate details (signed by ISRG Root X2): [ der] ( /certs/2024/e6.der ) , [ pem] ( /certs/2024/e6.pem ) , [ txt] ( /certs/2024/e6.txt )
180- * Certificate details (cross-signed by ISRG Root X1): [ der] ( /certs/2024/e6-cross.der ) , [ pem] ( /certs/2024/e6-cross.pem ) , [ txt] ( /certs/2024/e6-cross.txt )
187+ * Certificate details (signed by ISRG Root X2): [ crt.sh ] ( https://crt.sh/?id=12396132905 ) , [ der] ( /certs/2024/e6.der ) , [ pem] ( /certs/2024/e6.pem ) , [ txt] ( /certs/2024/e6.txt )
188+ * Certificate details (cross-signed by ISRG Root X1): [ crt.sh ] ( https://crt.sh/?id=12396132904 ) , [ der] ( /certs/2024/e6-cross.der ) , [ pem] ( /certs/2024/e6-cross.pem ) , [ txt] ( /certs/2024/e6-cross.txt )
181189* ** Let's Encrypt R3**
182190 * Subject: ` O = Let's Encrypt, CN = R3 `
183191 * Key type: ` RSA 2048 `
@@ -197,13 +205,13 @@ These intermediate CAs are no longer being used to issue Subscriber certificates
197205 * Key type: ` RSA 2048 `
198206 * Valid until: 2027-03-12
199207 * CA details: [ crt.sh] ( https://crt.sh/?caid=295814 ) , [ issued certs] ( https://crt.sh/?Identity=%25&iCAID=295814 )
200- * Certificate details (signed by ISRG Root X1): [ der] ( /certs/2024/r10.der ) , [ pem] ( /certs/2024/r10.pem ) , [ txt] ( /certs/2024/r10.txt )
208+ * Certificate details (signed by ISRG Root X1): [ crt.sh ] ( https://crt.sh/?id=12396132896 ) , [ der] ( /certs/2024/r10.der ) , [ pem] ( /certs/2024/r10.pem ) , [ txt] ( /certs/2024/r10.txt )
201209* ** Let's Encrypt R11**
202210 * Subject: ` O = Let's Encrypt, CN = R11 `
203211 * Key type: ` RSA 2048 `
204212 * Valid until: 2027-03-12
205213 * CA details: [ crt.sh] ( https://crt.sh/?caid=295815 ) , [ issued certs] ( https://crt.sh/?Identity=%25&iCAID=295815 )
206- * Certificate details (signed by ISRG Root X1): [ der] ( /certs/2024/r11.der ) , [ pem] ( /certs/2024/r11.pem ) , [ txt] ( /certs/2024/r11.txt )
214+ * Certificate details (signed by ISRG Root X1): [ crt.sh ] ( https://crt.sh/?id=12396132897 ) , [ der] ( /certs/2024/r11.der ) , [ pem] ( /certs/2024/r11.pem ) , [ txt] ( /certs/2024/r11.txt )
207215* ** Let's Encrypt Authority X1**
208216 * Subject: ` O = Let's Encrypt, CN = Let's Encrypt Authority X1 `
209217 * Key type: ` RSA 2048 `
0 commit comments