If you are doing certificate checking you should note that the LE X3 certificate we are currently shipping is going to expire a year from now. To prevent permanent breakage of OTA, we should ship both X3 and the ISRG root certificate, which is what they will use to sign the next certificate after X3 expires.
Originally posted by @kliment in #202 (comment)