Triggered by DST Root CA X3 Expiration on September 2021 and to maintain compatibility with older Android devices Let's Encrypt is making some upgrades on the default certificate chain on every certificate issued after May 4th.
With the current certificate issued before May 4th, the default chain looks like this: wikipedia.org cert <-- R3 <-- DST Root CA X3.
With the staged certificate issued on May 16th (it will be deployed on May 23rd) the default chain looks like this: wikipedia.org <-- R3 <-- ISRG Root X1 <-- DST Root CA X3
This will effectively duplicate the size of our certificate chain as it can be already seen on the acme-chief instances:
root@acmechief1001:/var/lib/acme-chief/certs/unified# ls -alh {live,new}/rsa-2048.chain.crt
-rw-r--r-- 1 acme-chief acme-chief 1.6K Mar 17 09:42 live/rsa-2048.chain.crt
-rw-r--r-- 1 acme-chief acme-chief 3.7K May 16 09:02 new/rsa-2048.chain.crt
root@acmechief1001:/var/lib/acme-chief/certs/unified# ls -alh {live,new}/ec-prime256v1.chain.crt
-rw-r--r-- 1 acme-chief acme-chief 1.6K Mar 17 09:42 live/ec-prime256v1.chain.crt
-rw-r--r-- 1 acme-chief acme-chief 3.7K May 16 09:01 new/ec-prime256v1.chain.crtLet's Encrypt is also offering an alternative chain that relies exclusively on ISRG Root X1:
root@acmechief1001:/var/lib/acme-chief/certs/unified# ls -alh new/{rsa-2048,ec-prime256v1}.alt.chain.crt
-rw-r--r-- 1 acme-chief acme-chief 1.8K May 16 09:01 new/ec-prime256v1.alt.chain.crt
-rw-r--r-- 1 acme-chief acme-chief 1.8K May 16 09:02 new/rsa-2048.alt.chain.crtThe downside regarding ISG Root X1 is older device compatibility, Android < 7.1.1, any iOS device not able to run iOS 10 among others would fail to establish a TLS connection if we were to use this certificate chain