As stated before, I’m angry that Let’s Encrypt started signing and issuing certificates with certificate chains that are invalid because they didn’t wait for the ca-certificates bundle to include their new root certs.
I tried to add a new feature to Nextcloud but it did not work because the chain of trust remained broken. This was slightly annoying, but not infuriating like being pinged every few seconds that the connection was unsecure.
Thankfully, this is solved by going here: Chains of Trust and choosing:
ISRG Root YR
Subject: C=US, O=ISRG, CN=Root YR
Key type: RSA 4096
Certificate details (cross-signed by ISRG Root X1): der, pem, txt
Download the file root-yr-by-x1.pem and then reconfigure a new fullchain.pem that includes it.
But yes, this proved to be a pain in the ass, because finding which certificates need to be in the fullchain file wasn’t clear. There ended up being three of them:
The first was the wildcard cert for the domain that came from the certbot renewal process:
subject=CN=domain.tld
issuer=C=US, O=Let's Encrypt, CN=YR1
notBefore=Jul 26 04:20:36 2026 GMT
notAfter=Oct 24 04:20:35 2026 GMT
The second was the intermediate cert that came from the certbot renewal process:
subject=C=US, O=Let's Encrypt, CN=YR1
issuer=C=US, O=ISRG, CN=Root YR
notBefore=Sep 3 00:00:00 2025 GMT
notAfter=Sep 2 23:59:59 2028 GMT
and the third was the cross-signed YR cert that came from the Chains of Trust page at https://letsencrypt.org/certificates/:
subject=C=US, O=ISRG, CN=Root YR
issuer=C=US, O=Internet Security Research Group, CN=ISRG Root X1
notBefore=May 13 00:00:00 2026 GMT
notAfter=Sep 2 23:59:59 2032 GMT