# Chain.pem with two entries - DST Root CA X3 deprecate **URL:** \ **Category:** Help\ **Created:** [December 27, 2021, 3:39pm UTC](https://community.letsencrypt.org/t/chain-pem-with-two-entries-dst-root-ca-x3-deprecate/168417 "2021-12-27T15:39:22Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![pcsystemd](https://avatars.discourse-cdn.com/v4/letter/p/d26b3c/32.png) [@pcsystemd](https://community.letsencrypt.org/u/pcsystemd)\ **Post date:** [December 27, 2021, 3:39pm UTC](https://community.letsencrypt.org/t/chain-pem-with-two-entries-dst-root-ca-x3-deprecate/168417/1 "2021-12-27T15:39:22Z")
Hello, Information needed openssl version: 1.0.1t certbot 1.9.0 I have a concern since the expiration regarding DST Root CA X3. When the SSL certificate is renewed, this is what one of our users has about the certificate for our domain "[domain.com](http://domain.com)" as a message. When I look at the chain.pem (see content below) and fullchain.pem files, I have since DST Root CA X3 expired two different entries in these files. The first one must be the default chain I suppose and the other the alternative chain according to [https://medium.com/geekculture/will-you-be-impacted-by-letsencrypt-dst-root-ca-x3-](https://medium.com/geekculture/will-you-be-impacted-by-letsencrypt-dst-root-ca-x3-) expiration-d54a018df257 or [Production Chain Changes](https://community.letsencrypt.org/t/production-chain-changes/150739). Contents of my chain.pem file: -----BEGIN CERTIFICATE----- MIIFFjCCAv ... nLRbwHOoq7hHwg== -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- MIIFYDCCB ... tPAQw4dy753ec5 -----END CERTIFICATE----- If I delete the second chain from the chain.pem and fullchain.pem files then it is no longer a problem as we can see below However if I understood correctly, the first chain is the default chain which contains (Default chain: End-entity certificate ← R3 ← ISRG Root X1 ← DST Root CA X3) and the second is the alternative chain which contains (Alternate chain : End-entity certificate ← R3 ← ISRG Root X1) so by removing the second string, the user should still get the message right? There is something that I did not understand! Is there a way to know for sure that it is the default chain and the alternate chain in chain.pem and fullchain.pem files? This is what the command gives after removing the second chain from chain.pem and fullchain.pem files: ## openssl s\_client -servername [domain.com](http://domain.com) -showcerts -connect [domain.com:443](http://domain.com:443) CONNECTED(00000003) depth=2 C = US, O = Internet Security Research Group, CN = ISRG Root X1 verify return:1 depth=1 C = US, O = Let's Encrypt, CN = R3 verify return:1 depth=0 CN = [domain.com](http://domain.com) verify return:1 ## Certificate chain 0 s:/CN=[domain.com](http://domain.com) i:/C=US/O=Let's Encrypt/CN=R3 -----BEGIN CERTIFICATE----- ktQ1laBnNwl8o7g== -----END CERTIFICATE----- 1 s:/CN=[domain.com](http://domain.com) i:/C=US/O=Let's Encrypt/CN=R3 -----BEGIN CERTIFICATE----- ktQ1laBnNwl8o7g== -----END CERTIFICATE----- 2 s:/C=US/O=Let's Encrypt/CN=R3 i:/C=US/O=Internet Security Research Group/CN=ISRG Root X1 -----BEGIN CERTIFICATE----- nLRbwHOoq7hHwg== -----END CERTIFICATE----- ## Server certificate subject=/CN=[domain.com](http://domain.com) issuer=/C=US/O=Let's Encrypt/CN=R3 ## No client certificate CA names sent ## SSL handshake has read 4463 bytes and written 447 bytes New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES128-GCM-SHA256 Server public key is 2048 bit Secure Renegotiation IS supported Compression: NONE Expansion: NONE SSL-Session: Protocol : TLSv1.2 Cipher : ECDHE-RSA-AES128-GCM-SHA256 Session-ID: Session-ID-ctx: Master-Key: 584D837005A1D1B76A20154CC6B2C75AFE7D4392212DB2 Key-Arg : None PSK identity: None PSK identity hint: None SRP username: None Start Time: 1640614264 Timeout : 300 (sec) Verify return code: 0 (ok) Thanks for your help. ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [December 27, 2021, 3:54pm UTC](https://community.letsencrypt.org/t/chain-pem-with-two-entries-dst-root-ca-x3-deprecate/168417/2 "2021-12-27T15:54:45Z")
> [@pcsystemd](#): > > so by removing the second string, the user should still get the message right? What message are they seeing exactly? And, can you describe what client (browser?) they are using and what version and oper sys it is on? Yes, you generally understand it correctly. For more details about the long and short chain see: > [@Long (default) and Short (alternate) Certificate Chains Explained](https://community.letsencrypt.org/t/long-default-and-short-alternate-certificate-chains-explained/162526): > > I… ---
**Author:** ![bruncsak](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/bruncsak/32/18414_2.png) [@bruncsak](https://community.letsencrypt.org/u/bruncsak)\ **Post date:** [December 27, 2021, 3:56pm UTC](https://community.letsencrypt.org/t/chain-pem-with-two-entries-dst-root-ca-x3-deprecate/168417/3 "2021-12-27T15:56:38Z")
`chain.pem` and `fullchain.pem` are containing the same signing certificate chain. The only difference is that the `fullchain.pem` contains the leaf certificate at the beginning in addition to. They are not alternates. ---
**Author:** ![pcsystemd](https://avatars.discourse-cdn.com/v4/letter/p/d26b3c/32.png) [@pcsystemd](https://community.letsencrypt.org/u/pcsystemd)\ **Post date:** [December 27, 2021, 4:07pm UTC](https://community.letsencrypt.org/t/chain-pem-with-two-entries-dst-root-ca-x3-deprecate/168417/4 "2021-12-27T16:07:15Z")
Sorry I forgot the screenshot. ![ssl](https://global.discourse-cdn.com/letsencrypt/original/3X/e/c/ec4101d25fb478b02f0e7180fa071efb2e517707.jpeg) ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [December 27, 2021, 4:20pm UTC](https://community.letsencrypt.org/t/chain-pem-with-two-entries-dst-root-ca-x3-deprecate/168417/5 "2021-12-27T16:20:31Z")
That is a normal display from SSL Labs. Try SSL Labs with this website name. The path #1 shows a trusted path and will be used by (most) browsers. There are exceptions for older or unusual clients. If someone is having a problem with some client can you provide more info about the program they are using? ---
**Author:** ![pcsystemd](https://avatars.discourse-cdn.com/v4/letter/p/d26b3c/32.png) [@pcsystemd](https://community.letsencrypt.org/u/pcsystemd)\ **Post date:** [December 28, 2021, 1:14pm UTC](https://community.letsencrypt.org/t/chain-pem-with-two-entries-dst-root-ca-x3-deprecate/168417/6 "2021-12-28T13:14:50Z")
> [@bruncsak](#): > > `chain.pem` and `fullchain.pem` are containing the same signing certificate chain. The only difference is that the `fullchain.pem` contains the leaf certificate at the beginning in addition to. They are not alternates. Yes Yes. in fact fullchain.pem contains the key of cert.pem + the key of chain.pem. What I have is two entries + a third entry since in the chain.pem file there are two keys, the default one it seems and the alternative chain so I have three entries in fullchain. pem ---
**Author:** ![pcsystemd](https://avatars.discourse-cdn.com/v4/letter/p/d26b3c/32.png) [@pcsystemd](https://community.letsencrypt.org/u/pcsystemd)\ **Post date:** [December 28, 2021, 1:16pm UTC](https://community.letsencrypt.org/t/chain-pem-with-two-entries-dst-root-ca-x3-deprecate/168417/7 "2021-12-28T13:16:37Z")
So my question is: Is it normal that I have two keys in chain.pem? And how can we know which is the default chain and which is the alternative chain? Thank you ---
**Author:** ![bruncsak](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/bruncsak/32/18414_2.png) [@bruncsak](https://community.letsencrypt.org/u/bruncsak)\ **Post date:** [December 28, 2021, 1:28pm UTC](https://community.letsencrypt.org/t/chain-pem-with-two-entries-dst-root-ca-x3-deprecate/168417/8 "2021-12-28T13:28:09Z")
You are seemingly using the term `key` in place of `certificate`. Please be a bit more precise in the terminology. It is important, because you really have one more file, which is the file containing the key for the leaf certificate. > [@pcsystemd](#): > > Is it normal that I have two keys in chain.pem? Yes, it is normal to have two certificates in the `chain.pem` file. > [@pcsystemd](#): > > And how can we know which is the default chain and which is the alternative chain? In the concrete case that must be the default chain (both in the `chain.pem` and `fullchain.pem` file). In the general case you can only know from the settings of your ACME client what chain it is configured to download from the ACME server at the time of the issuance of the requested certificate. ---
**Author:** ![pcsystemd](https://avatars.discourse-cdn.com/v4/letter/p/d26b3c/32.png) [@pcsystemd](https://community.letsencrypt.org/u/pcsystemd)\ **Post date:** [December 29, 2021, 5:30am UTC](https://community.letsencrypt.org/t/chain-pem-with-two-entries-dst-root-ca-x3-deprecate/168417/9 "2021-12-29T05:30:09Z")
> [@bruncsak](#): > > You are seemingly using the term `key` in place of `certificate` . Please be a bit more precise in the terminology. It is important, because you really have one more file, which is the file containing the key for the leaf certificate. > > > [@pcsystemd](#): > > > > Is it normal that I have two keys in chain.pem? > > Yes, it is normal to have two certificates in the `chain.pem` file. > > > [@pcsystemd](#): > > > > And how can we know which is the default chain and which is the alternative chain? > > In the concrete case that must be the default chain (both in the `chain.pem` and `fullchain.pem` file). > > In the general case you can only know from the settings of your ACME client what chain it is configured to download from the ACME server at the time of the issuance of the requested certificate. Thanks ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [January 28, 2022, 5:30am UTC](https://community.letsencrypt.org/t/chain-pem-with-two-entries-dst-root-ca-x3-deprecate/168417/10 "2022-01-28T05:30:45Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.