Upcoming Let’s Encrypt certificate chain change and impact for Cloudflare customers

A looming Let’s Encrypt chain change

Let’s Encrypt, the certificate authority (CA) Cloudflare relies on for TLS certificate issuance, has been operating with two separate certificate chains. One is cross-signed with IdenTrust, a long-established globally trusted CA; the other uses Let’s Encrypt’s own root, ISRG Root X1. Since Let’s Encrypt’s inception, ISRG Root X1 has steadily expanded its device compatibility.

That cross-sign with IdenTrust is set to expire on September 30, 2024. To get ahead of the deadline, Cloudflare will stop issuing certificates from the cross-signed chain on May 15, 2024, and will use the ISRG Root X1 chain for all new Let’s Encrypt certificates from that point onward.

The practical fallout is limited to legacy clients. Devices such as Android versions 7.1.1 and older do not hold ISRG Root X1 in their trust stores and exclusively rely on the cross-signed chain. Those systems may start seeing TLS errors or warnings for domains secured with Let’s Encrypt certificates. Per Let’s Encrypt’s data, over 93.9% of Android devices already trust ISRG Root X1, a share expected to keep climbing, particularly with Android 14 making the trust store easier to update automatically.

Cloudflare’s own telemetry shows that 2.96% of all Android requests come from devices that would be affected. Firefox users on Android are in a better position: only 1.13% of requests from that browser originate from affected versions, meaning 98.87% of Android Firefox requests won’t see an impact.

What you can do before the switch

For teams that control the clients hitting their applications, the straightforward fix is to update the local trust store to include ISRG Root X1. If you are using certificate pinning, remove or update the pin; Cloudflare generally advises against pinning, as it tends to break whenever certificates are renewed or the CA changes.

If you’re on Advanced Certificate Manager or SSL for SaaS with the Enterprise plan and do run into issues after the chain change, you can reconfigure your certificate to be issued by Google Trust Services instead of Let’s Encrypt. Detailed guidance is available in Cloudflare’s developer documentation.

While this transition will affect a small fraction of clients, Cloudflare supports the move as part of broader work toward a more flexible and secure Internet.

Why this change is a step forward

Historically, new security standards have taken a long time to catch on, held back by aging devices and browsers. When Cloudflare launched Universal SSL, free certificates simply didn’t exist; domain owners paid around $100 per TLS certificate, a real hurdle for small businesses at a time when browsers didn’t enforce TLS at all. Similarly, deprecating insecure algorithms like SHA-1 has been a slow process because older clients couldn’t handle newer ones.

The industry has had to make bold moves to accelerate progress. Let’s Encrypt’s launch in 2015 was a turning point, making free TLS certificates available to every domain and pushing HTTPS adoption to roughly 98% of traffic today. In 2014, Cloudflare introduced ECDSA support and issued ECDSA-only certificates to free customers, a decision that pushed both clients and operators to adapt and ultimately led to better performance and security.

Modern browsers and operating systems are increasingly designed to support new standards continuously, which paves the way for deprecating old ones. The retirement of the cross-signed chain is a push in that direction: it encourages devices, browsers, and clients to maintain adaptable trust stores. That, in turn, makes the PKI ecosystem less brittle and opens the door for new CAs to emerge without needing to spend years getting cross-signed by an incumbent.

The limitations of the current model are clear when you look at how few CAs enjoy broad trust. Google Trust Services, launched in 2017, still needed a cross-sign with GlobalSign’s CA to overcome device compatibility hurdles. By the time that cross-sign expires, the hope is that almost all traffic will come from modern clients, making the transition virtually seamless.