Neither certificate 1 nor 2 should be present there. 0 is your leaf, which is good. 1 is a very old leaf that has long expired and 2 is a retired intermediate.
It looks like you have misconfigured your server. You should be configuring your server to serve the fullchain file usually provided by your acme client.
I think it's because I didn't succeed the first time, so I asked for another certificate ... Can I remove it from my server just by deleting the 4 files (cert.pem, chain.pem, fullchain.pem & the privkey.pem) ?
My configuration server:
SSLEngine on
SSLCertificateFile "/opt/bitnami/apache2/conf/promis2.laophenixconsulting.com.crt"
SSLCertificateKeyFile "/opt/bitnami/apache2/conf/promis2.laophenixconsulting.com.key"
SSLCertificateChainFile "/etc/letsencrypt/live/laophenixconsulting.com/fullchain.pem"
My problem is that my SSLCertificateFile & SSLCertificateKeyFile are not from the same folder (maybe not the same certifcate request) that SSLCertificateChainFile ?
I'm confused of what to use, I have:
My cert.pem, chain.pem, fullchain.pem & the privkey.pem of my domain in /etc/letsencrypt/live/laophenixconsulting.com
Another crt, key and privatekey file of my subdomain in /opt/bitnami/apache2/conf/.
Should I use that to configure my web server ? It will cover all my subdomain ?
The certificate found in /opt/bitnami/apache2/conf/ is only valid for the hostname promis2.laophenixconsulting.com. It is currently valid and not expired. Based on the directory, I would say that is bitnami's acme client?
The certificate found in /etc/letsencrypt/live/laophenixconsulting.com (which is a directory used by certbot) is a wildcard which is valid for *.laophenixconsulting.com, laophenixconsulting.com. This certificate has expired on July 22 2020, over one year ago.
What to do depends on what you want to achieve:
Which hostnames do you have, want or need certificates for?
Which acme client do you want to use to get the certificates?
Once you have decided that we can work on getting that configuration to work. Also:
This is not correct, you usually do not need the SSLCertificateChainFile directive at all (Apache is capable of loading leaf + chain from SSLCertificateFile). If it is used, it must not be used with any fullchain.
I just need certificate for my subdomain (promis2.laophenixconsulting.com)
For my acme client I want to stay with the one located in /opt/bitnami/letsencrypt/accounts
So according to that I understand, I should have this configuration:
SSLEngine on
SSLCertificateFile "/opt/bitnami/apache2/conf/promis2.laophenixconsulting.com.crt"
SSLCertificateKeyFile "/opt/bitnami/apache2/conf/promis2.laophenixconsulting.com.key"
That's why some devices keep using the DST Root CA X3 ?
Yes, this is the correct default chain currently in use. Cert 1 is always required and cert 2 is in place for compatibility reasons for older Android phones (Android versions before 7.1.1).
