Tell certbot to prefer the legacy "DST Root CA X3" chain