title: Certbot generates certificate using DST Root CA X3
body: <p>I have a CentOS 7 machine where I am running httpd. I want to install a Letsencrypt certificate. I am using the following:
  <code>certbot certonly --standalone -d sub.domain.com</code></p>
  <p>Which generates the certificate and saves it to:</p>
  <ul>
  <li>/etc/letsencrypt/live/sub.domain.com/fullchain.pem</li>
  <li>/etc/letsencrypt/live/sub.domain.com/privkey.pem</li>
  </ul>
  <p>In my httpd configuration I am specifying the following:</p>
  <pre class="lang-sh prettyprint-override"><code>SSLCertificateFile /etc/letsencrypt/live/sub.domain.com/fullchain.pem
  SSLCertificateKeyFile /etc/letsencrypt/live/sub.domain.com/privkey.pem
  </code></pre>
  <p>When I browse to <a href="https://sub.domain.com" rel="nofollow noreferrer">https://sub.domain.com</a> I am getting an error that the certificate is not valid (due to expiration).</p>
  <p>I have checked the certificate with <code>openssl</code>:</p>
  <pre class="lang-sh prettyprint-override"><code>openssl x509 -in /etc/letsencrypt/live/sub.domain.com/fullchain.pem -noout -text
  </code></pre>
  <p>Output:</p>
  <pre class="lang-sh prettyprint-override"><code>    Signature Algorithm: sha256WithRSAEncryption
          Issuer: C=US, O=Let's Encrypt, CN=R3
          Validity
              Not Before: Dec 15 09:48:49 2021 GMT
              Not After : Mar 15 09:48:48 2022 GMT
  
              Authority Information Access: 
                  OCSP - URI:http://r3.o.lencr.org
                  CA Issuers - URI:http://r3.i.lencr.org/
  </code></pre>
  <p>So the certificate itself is not expired, but the intermediate Root X3 is expired, but why is the Root X3 certificate still being used?</p>
  <p>My <code>ca-certificates</code> package is up to date (<code>ca-certificates-2021.2.50-72.el7_9.noarch</code>).</p>
  <p><code>/etc/pki/tls/certs/ca-bundle.crt</code> does not contain the <code>Root X3</code> anymore. It does contain the <code>ISRG Root X1</code> certificate.</p>
  <p>What am I mising?</p>