Let's Encrypt root certificate expiry

[wildhart]

As per https://letsencrypt.org/docs/certificate-compatibility/ some of my users on iOS 9 can no longer access my website.

It looks like my site is using the legacy keychain with the expired root:

Is there a way in mup to force let's encrypt to use the modern keychain?

[wildhart]

Looks like this would need to expose the certbot preferred-chain parameter as per electron/electron#31212 (comment)

sudo certbot certonly --nginx -d <domain> --preferred-chain "ISRG Root X1"

And also we'd need to be using an appropriate version of certbot which supports this parameter.

[zodern]

We probably need to update to version 2 of https://github.com/nginx-proxy/acme-companion