From January next year, Let's Encrypt will issue certificates based on a new root. Test whether your Android device already supports it.
Let's Encrypt will make the switch on 11 January 2021. The new root has existed since 2015, and most devices already have the necessary updates and include ISRG Root X1.
But owners of Android devices older than 7.1.1 have a problem. That version came out in December 2016. If your Android is older, websites with the new certificate will be untrusted.
We have prepared test.vpsfree.cz so you can try it. This page already uses the new ISRG Root X1 root. Just open it in your chosen browser.
If you see an error about an invalid certificate authority, you have a problem. Your device has old software that does not know the new Let's Encrypt certificate authority. The solution is either to replace the old device that no longer receives security updates, or at least install Firefox for mobile. It handles certificates itself and updates them independently of the operating system.
If you want to try the new root yourself and use the ACME.sh client, you can use the following option when generating a certificate.
$ acme.sh --issue -d test.vpsfree.cz --preferred-chain "ISRG"
Until September next year, you can still manually request a certificate based on the old DST Root CA X3. After that, it will be over for good, because the original root expires.