No. Let's Encrypt keeps several intermediates in rotation, with backup ones that may start issuing at any time without warning. A pin on one intermediate can break your app overnight. Trust the platform store, or pin a public key you control, with a backup, if you must pin.
What the issuer publishes
The Let's Encrypt chains page, updated July 2026, lists four intermediates in active rotation: YE1 and YE2 with ECDSA keys, and YR1 and YR2 with RSA keys. Certificates with an ECDSA key come from an ECDSA intermediate and RSA ones from an RSA intermediate. It also lists backup intermediates, YE3 and YR3, which have valid certificates but are not issuing. The page says Let's Encrypt may begin issuing from them at any time, without warning. Earlier intermediates, such as E5 and E6, are retired.
So the intermediate your certificate chains to today is not guaranteed to be the one it chains to after the next renewal.
Why pinning an intermediate fails
| Pin target | What breaks it |
|---|---|
| One intermediate | Issuer starts using another, even a backup |
| One root | Issuer changes default chain, or a root is replaced |
| Your leaf key | Your own rotation, unless a backup pin exists |
| Your own CA key | Your own rotation, under your control |
The first two targets are controlled by someone else's schedule, so you cannot plan around them. The pinning specification's own advice, in RFC 7469, is to pin a key you hold and a backup you keep offline. See the lessons from RFC 7469.
What to do instead
- Ask whether you need pinning. For a typical web or mobile app, the platform trust store with proper hostname checking is a sound default. See certificate hostname verification.
- If you must pin, pin your own public key and add a backup, and renew keys on a schedule you control. A new key at each renewal breaks a leaf pin unless the backup is ready.
- If you need isolation from public authorities, run your own private CA, constrained to your names, and ship its certificate in the client. See name constraints.
- Keep the chain you serve complete, so clients that rely on the intermediates get them. See incomplete chains.
- Plan an update path for pins that does not require every user to upgrade.
Where Safeguard fits
Safeguard scans dependencies and SBOMs for known vulnerabilities, including those in the TLS and crypto libraries your projects pull in, and you can try it with the free scan at gold.safeguard.sh/scan.
Quick check
How many Let's Encrypt intermediates are active?
Four at the time of this review, plus backups that may begin issuing without notice. Check the chains page for the current list.
Is pinning the root safer than pinning the intermediate?
It breaks less often, but the issuer still controls it. Pin a key you control instead.
Sources
Last reviewed: 19 October 2026.
