diff --git a/core/nginx/conf/tls.conf b/core/nginx/conf/tls.conf
index f663bfd2..3970ed33 100644
--- a/core/nginx/conf/tls.conf
+++ b/core/nginx/conf/tls.conf
@@ -3,7 +3,7 @@ ssl_certificate_key {{ TLS[1] }};
 {% if TLS_FLAVOR in ['letsencrypt','mail-letsencrypt'] %}
 ssl_certificate {{ TLS[2] }};
 ssl_certificate_key {{ TLS[3] }};
-ssl_trusted_certificate /etc/ssl/certs/ca-cert-DST_Root_CA_X3.pem;
+ssl_trusted_certificate /etc/ssl/certs/ca-cert-ISRG_Root_X1.pem;
 {% endif %}
 ssl_session_timeout 1d;
 ssl_session_tickets off;
diff --git a/towncrier/newsfragments/2199.bugfix b/towncrier/newsfragments/2199.bugfix
new file mode 100644
index 00000000..e7ee3fb5
--- /dev/null
+++ b/towncrier/newsfragments/2199.bugfix
@@ -0,0 +1 @@
+Switch from DST_ROOT_X3 to ISRG_X1 as alpine is not shipping the former anymore