I don't think you understand how the CA system or Let's Encrypt works. IdenTrust signed Let's Encrypt's intermediate certificate[1] using their trusted root ce

I don't think you understand how the CA system or Let's Encrypt works. IdenTrust signed Let's Encrypt's intermediate certificate[1] using their trusted root certificate. This intermediate certificate has the CA flag set, so other certificates signed by it are to be trusted too. Intermediate certificates are used by all CAs. When you run the client on your server, the client submits a CSR to Let's Encrypt's CA server. Let's Encrypt will then verify domain ownership (via HTTP, TLS or DNS[2]). This is done in accordance with CA/B Baseline Requirements, and their practice doesn't differ from other CAs who also offer HTTP[3] or DNS verification. If ownership can be verified, Let's Encrypt will then sign your certificate using their trusted intermediate certificate and send it back to you. It is thus not self-signed, but signed by a trusted CA key. [1]: https://crt.sh/?caid=7395 https://crt.sh/?caid=7395 [2]: soon! [3]: At least one other CA (WoSign) does this, there are probably others I'm not aware of.