Description
Hi,
As of this moment, package.elm-lang.org is configured to use the Let's Encrypt default chain which includes the expired root certificate mentioned in the title. Let's Encrypt uses this to provide compatibility with Android 7 and earlier (which does not check the notAfter date on trust anchor certs), but use of this chain causes problems on many non-Android OSes.
Since Android compatibility is not a necessity for this service and this configuration causes breaks in other people's infrastructure, I suggest that Certbot be set (using --preferred-chain "ISRG Root X1") to use the short ISRG Root X1 chain instead. This should not cause issues as systems without that root in their trust stores will not accept the expired DST root either, but it will solve breakage for those of us with systems that reject the certificate chain upon encountering the expired root.