Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.
My domain is:
heavenly.cl
I ran this command:
Run the acme-companion container with the proper environment variables such that a DNS challenge is used (via acme.sh and its dns_*.sh API providers), can force renew:
docker exec acme-companion /app/force_renew
Then trying to connect to my server locally:
curl -v -H 'Host: www.heavenly.cl' https://localhost
It produced this output:
Info: DNS challenge using DNS API with the following keys: DO_API_KEY (default config)
Creating/renewal www.heavenly.cl certificates... (www.heavenly.cl)
[<time>] Using CA: https://acme-v02.api.letsencrypt.org/directory
[<time>] Using pre-generated key: /etc/acme.sh/admin@heavenly.cl/www.heavenly.cl/www.heavenly.cl.key.next
[<time>] Generating next pre-generate key.
[<time>] Single domain='www.heavenly.cl'
[<time>] Getting webroot for domain='www.heavenly.cl'
[<time>] www.heavenly.cl is already verified, skipping dns-01.
[<time>] Verification finished, beginning signing.
[<time>] Let's finalize the order.
[<time>] Le_OrderFinalize='https://acme-v02.api.letsencrypt.org/acme/finalize/2197043925/351846440985'
[<time>] Downloading cert.
[<time>] Le_LinkCert='https://acme-v02.api.letsencrypt.org/acme/cert/041b13d91c5c8ec671d45c61f5805850cb46'
[<time>] Cert success.
<certificate>
[<time>] Installing cert to: /etc/nginx/certs/www.heavenly.cl/cert.pem
[<time>] Installing CA to: /etc/nginx/certs/www.heavenly.cl/chain.pem
[<time>] Installing key to: /etc/nginx/certs/www.heavenly.cl/key.pem
[<time>] Installing full chain to: /etc/nginx/certs/www.heavenly.cl/fullchain.pem
Reloading nginx proxy (nginx-proxy)...
<time> Generated '/etc/nginx/conf.d/default.conf' from 3 containers
<time> [notice] 52#52: signal process started
Reloading nginx proxy (nginx-proxy)...
<time> Contents of /etc/nginx/conf.d/default.conf did not change. Skipping notification ''
<time> [notice] 68#68: signal process started
So this has generated a certificate and the server started using it, then through curl, the response is:
* Trying 127.0.0.1:443...
* Connected to localhost (127.0.0.1) port 443 (#0)
* ALPN: offers h2,http/1.1
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* CAfile: /etc/ssl/certs/ca-certificates.crt
* CApath: /usr/lib/ssl/certs
* TLSv1.3 (IN), TLS alert, unrecognized name (624):
* OpenSSL/3.0.15: error:0A000458:SSL routines::tlsv1 unrecognized name
* Closing connection 0
curl: (35) OpenSSL/3.0.15: error:0A000458:SSL routines::tlsv1 unrecognized name
My web server is (include version):
nginxproxy v1.7, nginx 1.27.3
The operating system my web server runs on is (include version):
Linux 6.6.62+rpt-rpi-v8 Debian aarch64
My hosting provider, if applicable, is:
n/a, domain on nic.cl, nameservers on digital ocean, dynamic dns with noip
I can login to a root shell on my machine (yes or no, or I don't know):
yes
I'm using a control panel to manage my site (no, or provide the name and version of the control panel):
no
The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):
acme.sh v.3.1.0
In addition, checking the fullchain against letsencrypt-r3, letsencrypt-e1, and ISRG_X1 and ISRG_X2 there seems to be no sign of those there (am I checking wrong?)
The Intermediate that is the current second cert in fullchain.pem would not be any of those. And, you will never see the actual root certs (X1 and X2) in the chain returned by the Let's Encrypt server. For the current Intermediates and chains see: