Describe the bug:

We try to issuer new certificates using prefered chain ISRG Root X1, but the new certificates always use DST Root CA X3 instead the new X1. Yml file use in the cluster issuer:

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt
  namespace: cert-manager
spec:
  acme:
    preferredChain: "ISRG Root X1"
...

Expected behaviour:
We want to test new root CA before 30 of september (finish date of X3 cert supported into cert-manager).

Steps to reproduce the bug:
Install cert-manager v1.4, add clusterissuer with the preferred chain option and deploy new certificate using ingress deploy (using secret value to deploy cert), but all new certificates was deployed with X3 root instead ISRG X1.

Anything else we need to know?:
Current deployment with X3 works fine.

Environment details::

• Kubernetes version: 1.21
• Cloud-provider/provisioner: AWS (EKS)
• cert-manager version: 1.4.0
• Install method: static manifests

/kind bug