Issue with SSL Certificate Configuration: "Certificate Chain is Incomplete"

Help
1

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is:
support.budapestschool.org
I ran this command:
certbot certonly --config-dir . --work-dir . --logs-dir . --manual --preferred-challenges dns
It produced this output:
Saving debug log to /srv/bps/letsencrypt.log
Plugins selected: Authenticator manual, Installer None
Please enter in your domain name(s) (comma and/or space separated) (Enter 'c'
to cancel): support.budapestschool.org
Cert is due for renewal, auto-renewing...
Renewing an existing certificate
Performing the following challenges:
dns-01 challenge for support.budapestschool.org

NOTE: The IP of this machine will be publicly logged as having requested this
certificate. If you're running certbot in manual mode on a machine that is not
your server, please ensure you're okay with that.

Are you OK with your IP being logged?

(Y)es/(N)o: y

Please deploy a DNS TXT record under the name
_acme-challenge.support.budapestschool.org with the following value:

s6CxK16xqWRF5ZAeFO0wY4UhlpV--8eKtUJ6drwUqZ8

Before continuing, verify the record is deployed.

Press Enter to Continue
Waiting for verification...
Cleaning up challenges

IMPORTANT NOTES:

  • Congratulations! Your certificate and chain have been saved at:
    /srv/bps/live/support.budapestschool.org/fullchain.pem
    Your key file has been saved at:
    /srv/bps/live/support.budapestschool.org/privkey.pem
    Your cert will expire on 2025-03-09. To obtain a new or tweaked
    version of this certificate in the future, simply run certbot
    again. To non-interactively renew all of your certificates, run
    "certbot renew"

  • If you like Certbot, please consider supporting our work by:

    Donating to ISRG / Let's Encrypt: Donate - Let's Encrypt
    Donating to EFF: Support EFF's Work on Let's Encrypt | Electronic Frontier Foundation
    My web server is (include version):
    nginx version: nginx/1.18.0 (Ubuntu)
    The operating system my web server runs on is (include version):
    NAME="Ubuntu"
    VERSION="20.04.3 LTS (Focal Fossa)"
    My hosting provider, if applicable, is:
    DigitalOcean
    I can login to a root shell on my machine (yes or no, or I don't know):
    yes
    I'm using a control panel to manage my site (no, or provide the name and version of the control panel):
    No
    The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):
    certbot 0.40.0

Desciption:
I generated an SSL certificate for my domain support.budapestschool.org using Certbot with the following command:

certbot certonly --config-dir . --work-dir . --logs-dir . --manual --preferred-challenges dns

The process was successful, and I received the fullchain.pem and privkey.pem files. However, when I uploaded them to my service, I received the error: "Certificate chain is incomplete."

From my understanding, the fullchain.pem file should include both the certificate and the intermediate certificates, but the error persists. I am trying to determine whether there is an issue with the certificate files I generated or if the problem lies with the service configuration.

2

support.budapestschool.org is currently serving the expired certificate.

What do you mean by "uploaded them to my service"? Because you say you aren't using any control panel. What kind of "service" requires "uploading"?

3

We use the LiveAgent ticketing system, which runs under our own domain, support.budapestschool.org. In the LiveAgent system, we need to update our SSL certificate every three months. When I attempt to perform the update, I receive this error message.

I have also contacted LiveAgent support, and they stated that they do not see any issues on their side.

4

And this "LiveAgent" system is some kind of "standalone" thing? It's not actually running the nginx you've mentioned on Ubuntu?

Because using fullchain.pem should in theory work, although sometimes one needs to upload cert.pem and chain.pem in separate fields, depending on the uploading system.

5

It looks like this LiveAgent system is using apache webserver under the hood:

Server: Apache/2.4.57 (Unix)

Are you trying to upload the certificate chain into LiveAgent via a web control panel or command line utility?

1 Like
6

No, they have a user interface where you can update the SSL, and an agent from LiveAgent support also tried doing it manually. However, they suggested that the generated fullchain.pem and privkey.pem files might be missing something.

I’m also skeptical about this. As I mentioned earlier, we have to update the SSL certificate every three months, essentially four times a year, and I’ve always been able to do it without any issues.

7

Could you provide please the output of the following command?

grep -e --- /srv/bps/live/support.budapestschool.org/fullchain.pem /srv/bps/live/support.budapestschool.org/privkey.pem
1 Like
8

Looking at your certificates the past time, all recent certificates, previous and current, were issued by R11. So no intermediate change (which is random between R10 and R11, but by chance you have only been issued certs signed by R11) which could explain why it suddenly wouldn't work. Even if your cert would have been issued by R10, there shouldn't be any issue, as one should not "pin" the intermediate. But in your case it's all R11..

I'm at a loss :man_shrugging:t2:

3 Likes
9

Thank you! This gives me the confidence to push the issue further with LiveAgent.

1 Like
10

/srv/bps/live/support.budapestschool.org/fullchain.pem:-----BEGIN CERTIFICATE-----
/srv/bps/live/support.budapestschool.org/fullchain.pem:-----END CERTIFICATE-----
/srv/bps/live/support.budapestschool.org/fullchain.pem:-----BEGIN CERTIFICATE-----
/srv/bps/live/support.budapestschool.org/fullchain.pem:-----END CERTIFICATE-----
/srv/bps/live/support.budapestschool.org/privkey.pem:-----BEGIN PRIVATE KEY-----
/srv/bps/live/support.budapestschool.org/privkey.pem:-----END PRIVATE KEY-----

11

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.