dehydrated issues certificate chains leading to expired root

Letsencrypt's root expired on 21 September:

https://letsencrypt.org/docs/dst-root-ca-x3-expiration-september-2021/

I have discovered a machine that is having letsencrypt certs be renewed, but the chain provided by dehydrated is providing the old cert chain that points at the expired cert.

Systems using old openssl (CentOS7 and below) then break in all sorts of ways.

To fix this, make sure the chain doesn't lead to an expired cert.