# CertBot Certificate Chain Automation Grade Cap
**URL:** https://community.letsencrypt.org/t/certbot-certificate-chain-automation-grade-cap/105368
**Category:** Help
**Created:** [November 2, 2019, 3:15pm UTC](https://community.letsencrypt.org/t/certbot-certificate-chain-automation-grade-cap/105368 "2019-11-02T15:15:30Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@alexhorner](https://community.letsencrypt.org/u/alexhorner)
#### Post date: [November 2, 2019, 3:15pm UTC](https://community.letsencrypt.org/t/certbot-certificate-chain-automation-grade-cap/105368/1 "2019-11-02T15:15:30Z")
**My domain is:** [cloudyhost.net](http://cloudyhost.net)
**My web server is (include version):** Apache 2.4.29 (Ubuntu)
**The operating system my web server runs on is (include version):** Ubuntu 18.04.2 LTS Server
**My hosting provider, if applicable, is:** Contabo
**I can login to a root shell on my machine (yes or no, or I don't know):** Yes
**I'm using a control panel to manage my site (no, or provide the name and version of the control panel):** No
**The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you're using Certbot):** Certbot 0.39.0
Hi there,
I have generated certificates for my domain via certbot, and configured them in Apache as SSLCertificateFile, SSLCertificateKeyFile and SSLCertificateChainFile.
I am using the fullchain in the domain live folder for the chain file.
SSL is working as expected, however Qualys SSL Labs check is capping me to Grade B saying
> This server's certificate chain is incomplete. Grade capped to B.
[https://www.ssllabs.com/ssltest/analyze.html?d=cloudyhost.net](https://www.ssllabs.com/ssltest/analyze.html?d=cloudyhost.net)
I have looked at the chain file myself and it is generated automatically as the cert.pem contents followed by the chain.pem contents.
I would like to achieve an A+ and this is the only thing preventing me. How can I fix this without manually modifying the chain file every single renewal?
---
### Author:  [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)
#### Post date: [November 2, 2019, 3:25pm UTC](https://community.letsencrypt.org/t/certbot-certificate-chain-automation-grade-cap/105368/2 "2019-11-02T15:25:43Z")
Hi @alexhorner
> [@alexhorner](#):
>
> I have generated certificates for my domain via certbot, and configured them in Apache as SSLCertificateFile, SSLCertificateKeyFile and SSLCertificateChainFile.
>
> I am using the fullchain in the domain live folder for the chain file.
looks like you have done something wrong. There is an incomplete chain - [https://check-your-website.server-daten.de/?q=cloudyhost.net#connections](https://check-your-website.server-daten.de/?q=cloudyhost.net#connections)
> Chain - incomplete
> 1 [CN=cloudyhost.net](http://CN=cloudyhost.net)
No intermediate certificate is sent.
Share these three rows with the SSLCertificateFile ... parameters. A server restart is required.
---
### Author:  [@alexhorner](https://community.letsencrypt.org/u/alexhorner)
#### Post date: [November 2, 2019, 3:27pm UTC](https://community.letsencrypt.org/t/certbot-certificate-chain-automation-grade-cap/105368/3 "2019-11-02T15:27:39Z")
Hi there,
Here are the directives
```
SSLEngine on
SSLCertificateFile /etc/letsencrypt/live/cloudyhost.net/cert.pem
SSLCertificateKeyFile /etc/letsencrypt/live/cloudyhost.net/privkey.pem
SSLCertificateChainFile /etc/letsencrypt/live/cloudyhost.net/privkey.pem
```
---
### Author:  [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)
#### Post date: [November 2, 2019, 3:32pm UTC](https://community.letsencrypt.org/t/certbot-certificate-chain-automation-grade-cap/105368/4 "2019-11-02T15:32:23Z")
That's wrong:
> [@alexhorner](#):
>
> SSLCertificateKeyFile /etc/letsencrypt/live/cloudyhost.net/privkey.pem
> SSLCertificateChainFile /etc/letsencrypt/live/cloudyhost.net/privkey.pem
SSLCertificateChainFile must have the fullchain.pem, not the privkey.pem a second time. Change it, restart the server, then recheck the domain.
---
### Author:  [@alexhorner](https://community.letsencrypt.org/u/alexhorner)
#### Post date: [November 2, 2019, 3:39pm UTC](https://community.letsencrypt.org/t/certbot-certificate-chain-automation-grade-cap/105368/5 "2019-11-02T15:39:12Z")
Oh man, I didn’t even notice, how embarrasing.
Thats a pretty bad misconfig. I probably need to renew my certificates now for private key security right?
The SSLLabs test passed now, thank you for your help!
---
### Author:  [@mnordhoff](https://community.letsencrypt.org/u/mnordhoff)
#### Post date: [November 3, 2019, 12:31am UTC](https://community.letsencrypt.org/t/certbot-certificate-chain-automation-grade-cap/105368/6 "2019-11-03T00:31:11Z")
The current configuration is still incorrect. 😓 It’s sending your certificate **twice** and the intermediate certificate once. Many clients will ignore the extra certificate, but some are stricter and will be unable to connect.
You need to use:
```auto
SSLCertificateFile /etc/letsencrypt/live/cloudyhost.net/cert.pem
SSLCertificateKeyFile /etc/letsencrypt/live/cloudyhost.net/privkey.pem
SSLCertificateChainFile /etc/letsencrypt/live/cloudyhost.net/chain.pem
```
Or, in Apache 2.4.8 or newer, the equivalent but more concise:
```auto
SSLCertificateFile /etc/letsencrypt/live/cloudyhost.net/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/cloudyhost.net/privkey.pem
```
---
### Author:  [@system](https://community.letsencrypt.org/u/system)
#### Post date: [December 3, 2019, 12:31am UTC](https://community.letsencrypt.org/t/certbot-certificate-chain-automation-grade-cap/105368/7 "2019-12-03T00:31:18Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.