Since our certificate renewed on 18 Aug 2026, the chain Vercel presents for our custom domain terminates at ISRG Root YR:
0 CN=blocks.zone1 Let's Encrypt YR12 ISRG Root YRNo cross-signed path to ISRG Root X1 is offered. A visitor in the United States gets ERR_SSL_PROTOCOL_ERROR on one WiFi network while the same phone loads the site normally over cellular — the signature of a TLS-inspecting appliance whose CA bundle predates the Generation Y roots.
Support confirmed there is no setting for this and pointed me here.
The ask is small: ACME (RFC 8555) exposes alternate chains via the Link rel="alternate" header, and Let's Encrypt publishes the Generation Y intermediates cross-signed to the long-trusted ISRG Root X1 through exactly that mechanism — the same way the DST Root CA X3 cross-sign was offered during the previous migration. Selecting that alternate chain is not new engineering; it is choosing one of the two chains the CA already returns at issuance.
Serving it would restore access for every visitor behind a pre-2026 CA bundle, on every Vercel-hosted domain, and would change nothing for modern clients. Either as the default during the transition, or as a per-domain preference.