@eswn I am running on tomcat and having the same problem. I followed @melo’s solution here: How to use the certificate for Tomcat to get letsencrypt certificate working great in Chrome. My question is what do I do to get this chain file you linked to added to my java keystore. I tried just importing it into my keystore and the import fails for alias tomcat but the import succeeds for alias root. But I try the updated keystore for the latter case in my production environment and it still does not resolve the firefox problem. What needs to happen to get letsencrypt working for tomcat and firefox?