Root Certificates Our roots are kept safely offline. We issue end-entity certificates to subscribers from the intermediates in the next section. For additional compatibility as we submit our new Root X2 to various root programs, we have also cross-signed it from Root X1.
Active  ISRG Root X1 (RSA 4096, O = Internet Security Research Group, CN = ISRG Root X1)  Self-signed: der, pem, txt Cross-signed by DST Root CA X3: der, pem, txt     Active, limited availability  ISRG Root X2 (ECDSA P-384, O = Internet Security Research Group, CN = ISRG Root X2)  Self-signed: der, pem, txt Cross-signed by ISRG Root X1: der, pem, txt      We’ve set up websites to test certificates chaining to our active roots.