On 11/02/2024 some letsencrypt certificates where updated in our cluster, and they were generated with the old certificate chain (signed by DST Root CA X3). We had configured as preferredChain in the clusterissuer "ISRG Root X1". It seems that after letsencrypt change in the default chain provided, the preferredChain configuration is not working properly.

https://community.letsencrypt.org/t/shortening-the-lets-encrypt-chain-of-trust/201580

To solve this, we removed the preferredChain configuration in the clusterissuer, and the certificate provided by letsencrypt was the right one (signed by ISRG Root X1). Is anyone else having this issue?

Our cert-manager version is 1.12.3