# Incorrect order and Extra certificate error **URL:** \ **Category:** Server\ **Created:** [January 12, 2016, 11:10pm UTC](https://community.letsencrypt.org/t/incorrect-order-and-extra-certificate-error/8759 "2016-01-12T23:10:09Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![flowmtl](https://avatars.discourse-cdn.com/v4/letter/f/e495f1/32.png) [@flowmtl](https://community.letsencrypt.org/u/flowmtl)\ **Post date:** [January 12, 2016, 11:10pm UTC](https://community.letsencrypt.org/t/incorrect-order-and-extra-certificate-error/8759/1 "2016-01-12T23:10:09Z")
Hi guys, I’m having an issue with my new Let’s Encrypt certificate. I’m using Apache 2.4.18, and I followed the tutorial to create my certificate as follows : **./letsencrypt-auto certonly --standalone -d [mywebsite.com](http://mywebsite.com) -d [www.mywebsite.com](http://www.mywebsite.com)** The Qualys SSL Labs test tells me that 3 certificates are provided (most websites running a Let’s encrypt certificate have only 2), and gives me the following error : **Chain issues - Incorrect order, Extra certs** When I check the detail of the certificates on Let’s encrypt, I see that Certificate #1 and #2 are exactly identitcal (same fingerprint, same sha256…) Certificate 1 Subject [mywebsite.com](http://mywebsite.com) Fingerprint SHA1: dku23dku23dku23dku23dku23dku23dku23dku23 Pin SHA256: OmDLmDLmDLmDLmDLmDLmDLmDLmDLmDLmDLmDLV Valid until Mon, 11 Apr 2016 21:06:00 UTC (expires in 2 months and 29 days) Key RSA 4096 bits (e 65537) Issuer Let’s Encrypt Authority X1 Signature algorithm SHA256withRSA Certificate 2 Subject [mywebsite.com](http://mywebsite.com) Fingerprint SHA1: dku23dku23dku23dku23dku23dku23dku23dku23 Pin SHA256: OmDLmDLmDLmDLmDLmDLmDLmDLmDLmDLmDLmDLV Valid until Mon, 11 Apr 2016 21:06:00 UTC (expires in 2 months and 29 days) Key RSA 4096 bits (e 65537) Issuer Let’s Encrypt Authority X1 Signature algorithm SHA256withRSA Certificate 3 is the Let’s Encrypt Authority X1 certificate. Nothing special here. httpd.conf is configured as follows : **Listen 443** _\ \*\* Documentroot /var/www/html/mywebsite.com_\* \*\* ServerName [mywebsite.com](http://mywebsite.com)\*\* \*\* ServerAlias [www.mywebsite.com](http://www.mywebsite.com)\*\* \*\* SSLEngine on\*\* \*\* SSLCertificateFile /etc/letsencrypt/live/mywebsite.com/cert.pem\*\* \*\* SSLCertificateKeyFile /etc/letsencrypt/live/mywebsite.com/privkey.pem\*\* \*\* SSLCertificateChainFile /etc/letsencrypt/live/mywebsite.com/fullchain.pem\*\* \*\* Header always set Strict-Transport-Security “max-age=63072000; includeSubdomains; preload”\*\* Am I missing something here? ---
**Author:** ![sahsanu](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/sahsanu/32/89984_2.png) [@sahsanu](https://community.letsencrypt.org/u/sahsanu)\ **Post date:** [January 12, 2016, 11:44pm UTC](https://community.letsencrypt.org/t/incorrect-order-and-extra-certificate-error/8759/2 "2016-01-12T23:44:42Z")
Hello @flowmtl, As you are using Apache 2.4.18, remove `SSLCertificateChainFile` directive and change `SSLCertificateFile` to link **fullchain.pem** instead of cert.pem. Reload Apache and try again. Cheers, sahsanu ---
**Author:** ![flowmtl](https://avatars.discourse-cdn.com/v4/letter/f/e495f1/32.png) [@flowmtl](https://community.letsencrypt.org/u/flowmtl)\ **Post date:** [January 13, 2016, 12:28am UTC](https://community.letsencrypt.org/t/incorrect-order-and-extra-certificate-error/8759/3 "2016-01-13T00:28:00Z")
Hello @sahsanu Thank you so much!!! That solves the issue 🙂 ---
**Author:** ![Geremia](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/geremia/32/25666_2.png) [@Geremia](https://community.letsencrypt.org/u/Geremia)\ **Post date:** [October 13, 2016, 4:50pm UTC](https://community.letsencrypt.org/t/incorrect-order-and-extra-certificate-error/8759/5 "2016-10-13T16:50:29Z")
This isn’t a big issue; see this: [https://community.qualys.com/docs/DOC-1931](https://community.qualys.com/docs/DOC-1931) ---
**Author:** ![cool110](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/cool110/32/8583_2.png) [@cool110](https://community.letsencrypt.org/u/cool110)\ **Post date:** [October 13, 2016, 5:09pm UTC](https://community.letsencrypt.org/t/incorrect-order-and-extra-certificate-error/8759/6 "2016-10-13T17:09:38Z")
No, that is correct for Apache 2.4, a separate cert and chain was only required for 2.2 and older. ---
**Author:** ![Shnoulle](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/shnoulle/32/9966_2.png) [@Shnoulle](https://community.letsencrypt.org/u/Shnoulle)\ **Post date:** [July 3, 2017, 1:50pm UTC](https://community.letsencrypt.org/t/incorrect-order-and-extra-certificate-error/8759/7 "2017-07-03T13:50:11Z")
And with apache 2.2 , do you know if there are a solution (except update to apache 2.4) ---
**Author:** ![mnordhoff](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mnordhoff/32/22583_2.png) [@mnordhoff](https://community.letsencrypt.org/u/mnordhoff)\ **Post date:** [July 3, 2017, 2:10pm UTC](https://community.letsencrypt.org/t/incorrect-order-and-extra-certificate-error/8759/8 "2017-07-03T14:10:04Z")
> [@Shnoulle](#): > > And with apache 2.2 , do you know if there are a solution (except update to apache 2.4) ``` SSLCertificateFile /etc/letsencrypt/live/example.com/cert.pem SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem SSLCertificateChainFile /etc/letsencrypt/live/example.com/chain.pem ``` You just need to use `chain.pem` instead of `fullchain.pem` to avoid duplicating the certificate. Works fine in Apache 2.2 (and 2.4, despite being deprecated). ---
**Author:** ![Shnoulle](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/shnoulle/32/9966_2.png) [@Shnoulle](https://community.letsencrypt.org/u/Shnoulle)\ **Post date:** [July 3, 2017, 3:21pm UTC](https://community.letsencrypt.org/t/incorrect-order-and-extra-certificate-error/8759/9 "2017-07-03T15:21:48Z")
Yep, i’m a little silly here , sorry and thanks 🙂 ---
**Author:** ![baoang](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/baoang/32/21024_2.png) [@baoang](https://community.letsencrypt.org/u/baoang)\ **Post date:** [March 10, 2018, 3:52am UTC](https://community.letsencrypt.org/t/incorrect-order-and-extra-certificate-error/8759/10 "2018-03-10T03:52:59Z")
Got the same problem under nignx. I am using Vesta control panel together with LE. After the reinstallation of the whole system, CentOS, and a recovery of LE into Vesta’s website config input boxes (there are three blank boxes for key, cert and pem input), I found from ssllabs server check that mine was `Incorrect order and Extra cert`. Well, then, I deleted one block of the two from the pem, the 3rd boxes which actually is `SSL Certificate Authority / Intermediate (optional)`, and conducted a second check via ssllabs. This time, the alert info disappeared with the following msg. ```auto |Certificates provided|2 (2705 bytes)| |---------------------|--------------| | Chain issues | None | ``` Well, I believe what I have deleted was the **optional** part (of that **intermediate** ).