I'm using AKS on Azure and Ingress with Let's Encrypt certificate (configured by https://docs.microsoft.com/en-us/azure/aks/ingress-static-ip)
The certificate chain defaults to DST Root CA X3 but I would like to change it to alternative ISRG Root X1
https://letsencrypt.org/certificates/#cross-signing says
Almost all server operators will choose to serve a chain including the intermediate certificate with Subject “Let’s Encrypt Authority X3” and Issuer “DST Root CA X3.”
Can you tell me, how can I change the default intermediate certificate to Let’s Encrypt Authority X3 (Signed by ISRG Root X1)?
I know ISRG Root X1 should become default on September 29, 2020 (https://letsencrypt.org/2019/04/15/transitioning-to-isrg-root.html) so I can just wait (not optimal). But after that this can be useful for someone who needs to keep DST Root CA X3