# Challenge failed for domain on Ubuntu/Apache **URL:** \ **Category:** Help\ **Created:** [September 10, 2024, 4:44pm UTC](https://community.letsencrypt.org/t/challenge-failed-for-domain-on-ubuntu-apache/225484 "2024-09-10T16:44:29Z")\ **Posts on this page:** 6\ **Page:** 2
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [September 11, 2024, 10:54pm UTC](https://community.letsencrypt.org/t/challenge-failed-for-domain-on-ubuntu-apache/225484/21 "2024-09-11T22:54:53Z")
> [@Cow](#): > > But on the Safari browser, it still does not have a secure connection. Do you know why? Oh, the cert could be improved like my earlier post but Safari might fail because you do not redirect HTTP to HTTPS. Did you try explicitly using [https://urbanbeach.com](https://urbanbeach.com)? You should add a redirect though unless you intentionally need to support HTTP Some modern browsers try HTTP and HTTPS simultaneously. And, perhaps Brave is one of those (if Chromium based then probably does). Safari might not I am not sure but it sounds like it. Unless of course Safari never worked then maybe what Bruce mentioned might apply ---
**Author:** ![Cow](https://avatars.discourse-cdn.com/v4/letter/c/ce73a5/32.png) [@Cow](https://community.letsencrypt.org/u/Cow)\ **Post date:** [September 12, 2024, 1:23pm UTC](https://community.letsencrypt.org/t/challenge-failed-for-domain-on-ubuntu-apache/225484/22 "2024-09-12T13:23:34Z")
I entered [https://urbanbeach.com](https://urbanbeach.com) into Safara and it worked. Thanks! I'm not sure what you mean by the following. Are they commands that I should run?: > The improvement is to change > SSLCertificateChainFile /etc/letsencrypt/live/urbanbeach.com/fullchain.pem > to > SSLCertificateChainFile /etc/letsencrypt/live/urbanbeach.com/chain.pem I'm not sure how to omit "ChainFile" or use the "fullchain.pem" for SSLCertificateFile. Where is the line for "ChainFile"? > On Apache versions since 2.4.8 you should actually omit the "ChainFile" line and use the "fullchain.pem" for SSLCertificateFile. Yours you do like above though ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [September 12, 2024, 1:41pm UTC](https://community.letsencrypt.org/t/challenge-failed-for-domain-on-ubuntu-apache/225484/23 "2024-09-12T13:41:29Z")
> [@Cow](#): > > I'm not sure what you mean by the following. Are they commands that I should run?: > > > The improvement is to change > > SSLCertificateChainFile /etc/letsencrypt/live/urbanbeach.com/fullchain.pem > > to > > SSLCertificateChainFile /etc/letsencrypt/live/urbanbeach.com/chain.pem No, in your Apache config file `/etc/apache2/sites-enabled/urbanbeach.com` you have these 3 lines in your VirtualHost for port 443 (HTTPS). ```nohighlight SSLCertificateFile /etc/letsencrypt/live/urbanbeach.com/cert.pem SSLCertificateKeyFile /etc/letsencrypt/live/urbanbeach.com/privkey.pem SSLCertificateChainFile /etc/letsencrypt/live/urbanbeach.com/fullchain.pem ``` Change the line for the SSLCertificateChainFile as I described (replacing fullchain.pem with chain.pem). > [@Cow](#): > > I'm not sure how to omit "ChainFile" or use the "fullchain.pem" for SSLCertificateFile. You cannot omit this line for ChainFile because your Apache is too old. I mentioned it only because you said you planned to migrate to a new system. When you have a modern Apache version you specify the above certificate lines differently. They look like this for versions 2.4.8 and later ```nohighlight SSLCertificateFile /etc/letsencrypt/live/urbanbeach.com/fullchain.pem SSLCertificateKeyFile /etc/letsencrypt/live/urbanbeach.com/privkey.pem ``` ---
**Author:** ![Cow](https://avatars.discourse-cdn.com/v4/letter/c/ce73a5/32.png) [@Cow](https://community.letsencrypt.org/u/Cow)\ **Post date:** [September 12, 2024, 7:59pm UTC](https://community.letsencrypt.org/t/challenge-failed-for-domain-on-ubuntu-apache/225484/24 "2024-09-12T19:59:37Z")
I changed it to full.chain as you suggested. I don't know what that is supposed to do. I renewed the certificate and it succeeded. On Safari, it still works the same way. Thanks for all your help. You were very knowledgeable. ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [September 12, 2024, 8:43pm UTC](https://community.letsencrypt.org/t/challenge-failed-for-domain-on-ubuntu-apache/225484/25 "2024-09-12T20:43:16Z")
> [@Cow](#): > > I changed it to full.chain as you suggested. Hope not. Instead of `fullchain.pem` that you had originally you should use `chain.pem` And, your server is currently sending chain.pem so looks like you did it right ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [October 12, 2024, 8:44pm UTC](https://community.letsencrypt.org/t/challenge-failed-for-domain-on-ubuntu-apache/225484/26 "2024-10-12T20:44:13Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed. [Previous page](https://community.letsencrypt.org/t/challenge-failed-for-domain-on-ubuntu-apache/225484.md?page=1)