Tell certbot to prefer the legacy "DST Root CA X3" chain

[chef.git] / cookbooks / letsencrypt / templates / default / request.erb

diff --git a/cookbooks/letsencrypt/templates/default/request.erb b/cookbooks/letsencrypt/templates/default/request.erb
index 6d4c2b1c2edfc330b9600727af2f1c80b01e38c2..365b315a7cfe52cd926c4a3030dd7324d86207e6 100644 (file)
--- a/cookbooks/letsencrypt/templates/default/request.erb
+++ b/cookbooks/letsencrypt/templates/default/request.erb
@@ -4,11 +4,13 @@
 
 /usr/bin/certbot certonly \
     --non-interactive \
+    --preferred-chain "DST Root CA X3" \
     --config-dir /srv/acme.openstreetmap.org/config \
     --work-dir /srv/acme.openstreetmap.org/work \
     --logs-dir /srv/acme.openstreetmap.org/logs \
     --email operations@osmfoundation.org \
     --agree-tos \
+    --expand \
 <% @domains.each do |domain| -%>
     --domain <%= domain %> \
 <% end -%>