I'm using Letsencrypt certificates for MQTT TLS, and it works great, however I'm a little confused about the use of chain.pem as a CA certificate.
In this post;
@schoen says that the chain.pem → cacert.pem so I've used chain.pem as the CA Certificate in the TLS configuration.
However, others have advised that root certificate verification should be provided via Debian's trusted root cert list, such as DST_Root_CA_X3.pem and not chain.pem
Could anyone advise the pro's & con's of those two certificates please?
Chain.pem should NOT contain the actual root cert.
Root certs should be known (or obtained/updated by other methods).
The chain.pem should provide all the necessary intermediary certs to complete the chain.
The last link in the chain(.pem) should point to an already trusted root cert (within your store).
So to answer your question:
“Letsencrypt chain.pem or trusted root list cert?”
You need both; because they are different and are both required to complete the chain of trust.
Your first version is wrong, there is the root certificate included.
Your second may be correct, but chain.pem must have only one certificate (the intermediate certificate). If chain.pem has both certificates, remove the leaf certificate (it’s in cert.pem).
Change your configuration to use (2), then recheck your domain.
chain.pem has only one certificate in it, whilst fullchain.pem has two, although I am not using chain.pem in the node-RED server config anyway, just privkey.pem and cert.pem could that be the cause of the Chain Incomplete error?
(this is the way node-RED enables HTTPS)
// The following property can be used to enable HTTPS
// See http://nodejs.org/api/https.html#https_https_createserver_options_re$
// for details on its contents.
// See the comment at the top of this file on how to load the `fs` module u$
// this setting.
//
https: {
key: fs.readFileSync('/home/pi/.node-red/certs/privkey.pem'),
cert: fs.readFileSync('/home/pi/.node-red/certs/cert.pem')
},
