# Chain is not working **URL:** \ **Category:** Help\ **Created:** [February 2, 2018, 7:11pm UTC](https://community.letsencrypt.org/t/chain-is-not-working/52047 "2018-02-02T19:11:23Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![Robciks1234](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/robciks1234/32/17928_2.png) [@Robciks1234](https://community.letsencrypt.org/u/Robciks1234)\ **Post date:** [February 2, 2018, 7:11pm UTC](https://community.letsencrypt.org/t/chain-is-not-working/52047/1 "2018-02-02T19:11:23Z")
Hello. I today installed SSL certificates on my site. I checked if everything’s OK at [SSL Shopper](https://www.sslshopper.com) and it says that Chain is not complete. How to fix it? Thanks. ---
**Author:** ![jared.m](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jared.m/32/17871_2.png) [@jared.m](https://community.letsencrypt.org/u/jared.m)\ **Post date:** [February 2, 2018, 7:42pm UTC](https://community.letsencrypt.org/t/chain-is-not-working/52047/2 "2018-02-02T19:42:36Z")
Could you give us a bit more background on _how_ you installed these on your site? The suggested questions you were presented with when you made the topic give us a lot of information needed to help you. That message is telling you that you’re not presenting the full certificate chain, but depending on your setup you’ll either need to use fullchain.pem, or cert.pem and chain.pem in different places. ---
**Author:** ![Robciks1234](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/robciks1234/32/17928_2.png) [@Robciks1234](https://community.letsencrypt.org/u/Robciks1234)\ **Post date:** [February 2, 2018, 7:55pm UTC](https://community.letsencrypt.org/t/chain-is-not-working/52047/3 "2018-02-02T19:55:54Z")
Yeah, sure! I installed my site by adding DNS and my site is using Cloudflare also. When setup was completed, I used the certificate provided, not that CA bundle (because it wasn’t working). Could you please tell me where I can find my root certificate? ---
**Author:** ![jared.m](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jared.m/32/17871_2.png) [@jared.m](https://community.letsencrypt.org/u/jared.m)\ **Post date:** [February 2, 2018, 7:56pm UTC](https://community.letsencrypt.org/t/chain-is-not-working/52047/4 "2018-02-02T19:56:55Z")
What certificate filenames do you have? ---
**Author:** ![Robciks1234](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/robciks1234/32/17928_2.png) [@Robciks1234](https://community.letsencrypt.org/u/Robciks1234)\ **Post date:** [February 2, 2018, 9:04pm UTC](https://community.letsencrypt.org/t/chain-is-not-working/52047/5 "2018-02-02T21:04:29Z")
What do you mean by ‘filenames’? I simply used certificate not CA bundle. ---
**Author:** ![\_az](https://avatars.discourse-cdn.com/v4/letter/_/22d042/32.png) [@\_az](https://community.letsencrypt.org/u/_az)\ **Post date:** [February 2, 2018, 9:38pm UTC](https://community.letsencrypt.org/t/chain-is-not-working/52047/6 "2018-02-02T21:38:09Z")
Many Let's Encrypt clients will generate multiple files, e.g. `fullchain.pem` as well as `cert.pem`. Most of the time (such as with nginx or Apache web servers), you should use `fullchain.pem` as it contains both the certificate and the intermediates. Using `cert.pem` would just lead to the incomplete chain problem you have today. > [@Robciks1234](#): > > because it wasn’t working What happened when you tried to use `fullchain.pem`? It _is_ the correct choice, but if you experienced problems with it, that's where you should focus your attention. > [@Robciks1234](#): > > Could you please tell me where I can find my root certificate? To directly answer your question, all of the intermediates and roots are available from [Chain of Trust - Let's Encrypt](https://letsencrypt.org/certificates/). You most likely want "Let’s Encrypt Authority X3 (IdenTrust cross-signed)". There is no point bundling any of the roots, since they are trust anchors anyway. You may also want to tell us what your domain is and how you obtained the Let's Encrypt certificate, so we can give you more specific answers. ---
**Author:** ![Robciks1234](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/robciks1234/32/17928_2.png) [@Robciks1234](https://community.letsencrypt.org/u/Robciks1234)\ **Post date:** [February 3, 2018, 5:57pm UTC](https://community.letsencrypt.org/t/chain-is-not-working/52047/7 "2018-02-03T17:57:16Z")
![sslchain](https://global.discourse-cdn.com/letsencrypt/original/3X/0/9/095e891c6e743590782755bbbe44797fb64b9beb.png) I’ve verified my page by DNS, and here’s what I’ve got in the result - certificate and CA bundle. Certificate works fine, but CA bundle is not working. And when I download SSL files, I see only ca\_bundle.crt, private.key and certificate.crt. I use [https://sslforfree.com](https://sslforfree.com) which uses Let’s Encrypt. Thanks. ---
**Author:** ![\_az](https://avatars.discourse-cdn.com/v4/letter/_/22d042/32.png) [@\_az](https://community.letsencrypt.org/u/_az)\ **Post date:** [February 4, 2018, 1:19am UTC](https://community.letsencrypt.org/t/chain-is-not-working/52047/8 "2018-02-04T01:19:44Z")
You can replicate `fullchain.pem` by appending the CA bundle to the end of the certificate. But this depends how you use them in your web server (the specific configuration directives). > [@Robciks1234](#): > > but CA bundle is not working You might try to be much more specific in your responses. How are you configuring the certificate and bundle on your web server, what errors do you get, if any, what is your domain name? ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [March 6, 2018, 1:19am UTC](https://community.letsencrypt.org/t/chain-is-not-working/52047/9 "2018-03-06T01:19:46Z")
Closed on March 6, 2018, 1:19am UTC This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.