# Renewal not include intermidiate **URL:** \ **Category:** Help\ **Created:** [May 4, 2020, 9:52am UTC](https://community.letsencrypt.org/t/renewal-not-include-intermidiate/121600 "2020-05-04T09:52:04Z")\ **Posts on this page:** 19\ **Page:** 1
**Author:** ![gamliel](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/gamliel/32/39394_2.png) [@gamliel](https://community.letsencrypt.org/u/gamliel)\ **Post date:** [May 4, 2020, 9:52am UTC](https://community.letsencrypt.org/t/renewal-not-include-intermidiate/121600/1 "2020-05-04T09:52:04Z")
Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. [https://crt.sh/?q=example.com](https://crt.sh/?q=example.com)), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help. My domain is:clientzone.budsfx.com I ran this command: It produced this output: My web server is (include version): The operating system my web server runs on is (include version): My hosting provider, if applicable, is: I can login to a root shell on my machine (yes or no, or I don’t know): I’m using a control panel to manage my site (no, or provide the name and version of the control panel): The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you’re using Certbot): hi after export pfx that include fullchain after renewal the intermidiate information is not included and its makes me trouble is there a way that the auto renewal process will include intermidiate? thanks ---
**Author:** ![9peppe](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/9peppe/32/31596_2.png) [@9peppe](https://community.letsencrypt.org/u/9peppe)\ **Post date:** [May 4, 2020, 10:26am UTC](https://community.letsencrypt.org/t/renewal-not-include-intermidiate/121600/2 "2020-05-04T10:26:07Z")
This depends on your acme client. What is your acme client? ---
**Author:** ![gamliel](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/gamliel/32/39394_2.png) [@gamliel](https://community.letsencrypt.org/u/gamliel)\ **Post date:** [May 4, 2020, 10:55am UTC](https://community.letsencrypt.org/t/renewal-not-include-intermidiate/121600/3 "2020-05-04T10:55:08Z")
im using acme run powershell script from azure automation ---
**Author:** ![gamliel](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/gamliel/32/39394_2.png) [@gamliel](https://community.letsencrypt.org/u/gamliel)\ **Post date:** [May 4, 2020, 10:56am UTC](https://community.letsencrypt.org/t/renewal-not-include-intermidiate/121600/4 "2020-05-04T10:56:52Z")
####################################################################################### # Script that renews a Let’s Encrypt certificate for an Azure Application Gateway # Pre-requirements: # - Have a storage account in which the folder path has been created: # ‘/.well-known/acme-challenge/’, to put here the Let’s Encrypt DNS check files # - Add “Path-based” rule in the Application Gateway with this configuration: # - Path: ‘/.well-known/acme-challenge/\*’ # - Check the configure redirection option # - Choose redirection type: permanent # - Choose redirection target: External site # - Target URL: # - Example: ‘[https://test.blob.core.windows.net/public](https://test.blob.core.windows.net/public)’ # - For execution on Azure Automation: Import ‘AzureRM.profile’, ‘AzureRM.Network’ # and ‘ACMESharp’ modules in Azure # # UPDATE 2019-11-27 # - Due to deprecation of ACMEv1, a new script is required to use ACMEv2. # The module to use is called ACME-PS. # ####################################################################################### Param( [string]$domain, [string]$EmailAddress, [string]$STResourceGroupName, [string]$storageName, [string]$AGResourceGroupName, [string]$AGName, [string]$AGOldCertName ) ## Azure Login # If Runbook for Azure Automation $connection = Get-AutomationConnection -Name AzureRunAsConnection Login-AzureRmAccount -ServicePrincipal -Tenant $connection.TenantID -ApplicationID $connection.ApplicationID -CertificateThumbprint $connection.CertificateThumbprint # Create a state object and save it to the harddrive $state = New-ACMEState -Path $env:TEMP $serviceName = ‘LetsEncrypt’ # Fetch the service directory and save it in the state Get-ACMEServiceDirectory $state -ServiceName $serviceName -PassThru; # Get the first anti-replay nonce New-ACMENonce $state; # Create an account key. The state will make sure it’s stored. New-ACMEAccountKey $state -PassThru; # Register the account key with the acme service. The account key will automatically be read from the state New-ACMEAccount $state -EmailAddresses $EmailAddress -AcceptTOS; # Load an state object to have service directory and account keys available $state = Get-ACMEState -Path $env:TEMP; # It might be neccessary to acquire a new nonce, so we’ll just do it for the sake of the example. New-ACMENonce $state -PassThru; # Create the identifier for the DNS name $identifier = New-ACMEIdentifier $domain; # Create the order object at the ACME service. $order = New-ACMEOrder $state -Identifiers $identifier; # Fetch the authorizations for that order $authZ = Get-ACMEAuthorization -State $state -Order $order; # Select a challenge to fullfill $challenge = Get-ACMEChallenge $state $authZ “http-01”; # Inspect the challenge data $challenge.Data; # Create the file requested by the challenge $fileName = $env:TMP + ‘’ + $challenge.Token; Set-Content -Path $fileName -Value $challenge.Data.Content -NoNewline; $blobName = “.well-known/acme-challenge/” + $challenge.Token $storageAccount = Get-AzureRmStorageAccount -ResourceGroupName $STResourceGroupName -Name $storageName $ctx = $storageAccount.Context Set-AzureStorageBlobContent -File $fileName -Container “public” -Context $ctx -Blob $blobName # Signal the ACME server that the challenge is ready $challenge | Complete-ACMEChallenge $state; # Wait a little bit and update the order, until we see the states while($order.Status -notin (“ready”,“invalid”)) { Start-Sleep -Seconds 10; $order | Update-ACMEOrder $state -PassThru; } # We should have a valid order now and should be able to complete it # Therefore we need a certificate key $certKey = New-ACMECertificateKey -Path “$env:TEMP$domain.key.xml”; # Complete the order - this will issue a certificate singing request Complete-ACMEOrder $state -Order $order -CertificateKey $certKey; # Now we wait until the ACME service provides the certificate url while(-not $order.CertificateUrl) { Start-Sleep -Seconds 15 $order | Update-Order $state -PassThru } # As soon as the url shows up we can create the PFX $password = ConvertTo-SecureString -String “Passw@rd123\*\*\*” -Force -AsPlainText Export-ACMECertificate $state -Order $order -CertificateKey $certKey -Path “$env:TEMP$domain.pfx” -Password $password; # Delete blob to check DNS Remove-AzureStorageBlob -Container “public” -Context $ctx -Blob $blobName ### RENEW APPLICATION GATEWAY CERTIFICATE $appgw = Get-AzureRmApplicationGateway -ResourceGroupName $AGResourceGroupName -Name $AGName Set-AzureRmApplicationGatewaySSLCertificate -Name $AGOldCertName -ApplicationGateway $appgw -CertificateFile “$env:TEMP$domain.pfx” -Password $password Set-AzureRmApplicationGateway -ApplicationGateway $appgw ---
**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\ **Post date:** [May 4, 2020, 11:05am UTC](https://community.letsencrypt.org/t/renewal-not-include-intermidiate/121600/5 "2020-05-04T11:05:37Z")
Hi @gamliel > [@gamliel](#): > > after export pfx that include fullchain after renewal the intermidiate information is not included and its makes me trouble is there a way that the auto renewal process will include intermidiate? there are older topics with the same domain name - [Unable to renew certificate with redirect cpanel and application gateway](https://community.letsencrypt.org/t/unable-to-renew-certificate-with-redirect-cpanel-and-application-gateway/117082) - looks like you have changed your user name. That's bad because the history is missing. And checking your domain - [clientzone.budsfx.com - Make your website better - DNS, redirects, mixed content, certificates](https://check-your-website.server-daten.de/?q=clientzone.budsfx.com) - there is the intermediate certificate sent. > Chain (complete) 1 [CN=clientzone.budsfx.com](http://CN=clientzone.budsfx.com) > > * * * > > 2 CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US But there is a redirect to `https://clientzone.easyfx.eu/`, there is an incomplete chain: > Chain - incomplete > 1 CN=clientzone.easyfx.eu But there is an Apache, so normally you don't use a .pfx file. ---
**Author:** ![gamliel](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/gamliel/32/39394_2.png) [@gamliel](https://community.letsencrypt.org/u/gamliel)\ **Post date:** [May 4, 2020, 11:23am UTC](https://community.letsencrypt.org/t/renewal-not-include-intermidiate/121600/6 "2020-05-04T11:23:49Z")
yes i exported from certbot the fullchain and than it worked but when the renewal appears than i lost intermidiate ---
**Author:** ![gamliel](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/gamliel/32/39394_2.png) [@gamliel](https://community.letsencrypt.org/u/gamliel)\ **Post date:** [May 4, 2020, 1:11pm UTC](https://community.letsencrypt.org/t/renewal-not-include-intermidiate/121600/7 "2020-05-04T13:11:59Z")
hi when i login to the website im not getting any redirect to easyfx do you have any soltion can help me? ---
**Author:** ![gamliel](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/gamliel/32/39394_2.png) [@gamliel](https://community.letsencrypt.org/u/gamliel)\ **Post date:** [May 4, 2020, 1:34pm UTC](https://community.letsencrypt.org/t/renewal-not-include-intermidiate/121600/8 "2020-05-04T13:34:35Z")
maybe you see also easyfx cause i have multiple websites on the same server and ip ---
**Author:** ![gamliel](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/gamliel/32/39394_2.png) [@gamliel](https://community.letsencrypt.org/u/gamliel)\ **Post date:** [May 4, 2020, 3:15pm UTC](https://community.letsencrypt.org/t/renewal-not-include-intermidiate/121600/9 "2020-05-04T15:15:03Z")
please help im really dont know what to do ---
**Author:** ![gamliel](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/gamliel/32/39394_2.png) [@gamliel](https://community.letsencrypt.org/u/gamliel)\ **Post date:** [May 6, 2020, 9:03am UTC](https://community.letsencrypt.org/t/renewal-not-include-intermidiate/121600/10 "2020-05-06T09:03:47Z")
Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. [https://crt.sh/?q=example.com](https://crt.sh/?q=example.com)), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help. My domain is:clientzone.budsfx.com I ran this command: It produced this output: My web server is (include version): The operating system my web server runs on is (include version): My hosting provider, if applicable, is: I can login to a root shell on my machine (yes or no, or I don’t know): I’m using a control panel to manage my site (no, or provide the name and version of the control panel): The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you’re using Certbot): try to refrase the question i have exported fullchain from certbot to pfx file and configure it on azure application gateway. but when acme challenge autorenewal script runs it removes the intermediate data but the certificates renews. is it possible renewal process with acme http-01 will include the intermediate? cause i have grade B and chain incomplete after the renewal. ---
**Author:** ![\_az](https://avatars.discourse-cdn.com/v4/letter/_/22d042/32.png) [@\_az](https://community.letsencrypt.org/u/_az)\ **Post date:** [May 6, 2020, 9:18am UTC](https://community.letsencrypt.org/t/renewal-not-include-intermidiate/121600/11 "2020-05-06T09:18:03Z")
The `fullchain.pem` generated by Certbot always includes the intermediate, as the second certificate in the chain. If you want them separately, it’s `cert.pem` and `chain.pem`. If it’s missing from your PFX, it’s an issue with the way you are creating the PFX. ---
**Author:** ![gamliel](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/gamliel/32/39394_2.png) [@gamliel](https://community.letsencrypt.org/u/gamliel)\ **Post date:** [May 6, 2020, 9:39am UTC](https://community.letsencrypt.org/t/renewal-not-include-intermidiate/121600/12 "2020-05-06T09:39:41Z")
i know when i exported the from certbot with fullchain the cert was ok but i have the script i attached for autorenewal with acme-challenge and with it renews the cert its missing the intermidiate. ---
**Author:** ![\_az](https://avatars.discourse-cdn.com/v4/letter/_/22d042/32.png) [@\_az](https://community.letsencrypt.org/u/_az)\ **Post date:** [May 6, 2020, 9:52am UTC](https://community.letsencrypt.org/t/renewal-not-include-intermidiate/121600/13 "2020-05-06T09:52:11Z")
Well, looking at the PS library you are using ([GitHub - PKISharp/ACME-PS: PowerShell module supporting ACME v2 certificate management](https://github.com/PKISharp/ACMESharpCore-PowerShell)), it seems that it doesn't support exporting the intermediate with `Export-ACMECertificate`. Which is ... a problem for you. > The certificate chain is not part of the issued certifcate. To get a correct certificate chain, you'll need to import the intermediate certificates from your acme service. For Lets Encrypt you can obtain them via [https://letsencrypt.org/certificates/.](https://letsencrypt.org/certificates/) I guess you would have to manually import the intermediate from the website into the PFX, as part of your PS automation. This comment appears to have a workaround for what you want: [Full chain certificate · Issue #57 · PKISharp/ACME-PS · GitHub](https://github.com/PKISharp/ACMESharpCore-PowerShell/issues/57#issuecomment-584522249) . This seems like an odd design for an ACME client. The certificate chain _is_ sent from the CA server and shouldn't be managed manually by end-users. I can't offer you a solution for this PS library, but I know of a different one that gives you the intermediate: [GitHub - rmbolger/Posh-ACME: PowerShell module and ACME client to create certificates from Let's Encrypt (or other ACME CA)](https://github.com/rmbolger/Posh-ACME) , From [https://github.com/rmbolger/Posh-ACME/blob/master/Tutorial.md#your-first-certificate](https://github.com/rmbolger/Posh-ACME/blob/master/Tutorial.md#your-first-certificate) : > Then if the ACME server is able to properly validate the TXT record, the final certificate files are generated and the command should output the details of your new certificate. Only a subset of the details are displayed by default. To see them all, run `Get-PACertificate | fl` . The files generated in the output folder should contain the following: > > - **cert.cer** (Base64 encoded PEM certificate) > - **cert.key** (Base64 encoded PEM private key) > - **cert.pfx** (PKCS12 container with cert+key) > - **chain.cer** (Base64 encoded PEM with the issuing CA certificate chain) > - **fullchain.cer** (Base64 encoded PEM with cert+chain) > - **fullchain.pfx** (PKCS12 container with cert+key+chain) ---
**Author:** ![gamliel](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/gamliel/32/39394_2.png) [@gamliel](https://community.letsencrypt.org/u/gamliel)\ **Post date:** [May 6, 2020, 4:00pm UTC](https://community.letsencrypt.org/t/renewal-not-include-intermidiate/121600/14 "2020-05-06T16:00:17Z")
thanks i was able to export but now have other message ### One of the certificates is signed with a SHA1 signature. We recommend that you reissue or replace this certificate with one that uses a SHA-2 signature. Contact your SSL provider about how to do this. Read more about the [SHA-1 deprecation here](https://community.qualys.com/blogs/securitylabs/2014/09/09/sha1-deprecation-what-you-need-to-know). ---
**Author:** ![\_az](https://avatars.discourse-cdn.com/v4/letter/_/22d042/32.png) [@\_az](https://community.letsencrypt.org/u/_az)\ **Post date:** [May 6, 2020, 10:27pm UTC](https://community.letsencrypt.org/t/renewal-not-include-intermidiate/121600/15 "2020-05-06T22:27:57Z")
Where is that message coming from? It is true that the “DST Root CA X3” sports a SHA-1 signature, but it doesn’t matter, because it’s a trust anchor - it’s self-signed. Browsers don’t care about it and there’s no negative security consequence. If the warning is not about the root certificate, then please share the link or screenshot where you see that message. ---
**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\ **Post date:** [May 6, 2020, 10:38pm UTC](https://community.letsencrypt.org/t/renewal-not-include-intermidiate/121600/16 "2020-05-06T22:38:47Z")
> [@\_az](#): > > Where is that message coming from? See there > [@One of the certificates is signed with a SHA1 signature. We recommend that you reissue or replace this certificate with one that uses a SHA-2 signature. Contact your SSL provider about how to do this. Read more about the SHA-1 deprecation here](https://community.letsencrypt.org/t/one-of-the-certificates-is-signed-with-a-sha1-signature-we-recommend-that-you-reissue-or-replace-this-certificate-with-one-that-uses-a-sha-2-signature-contact-your-ssl-provider-about-how-to-do-this-read-more-about-the-sha-1-deprecation-here/121921/2): > > Y… ```nohighlight Chain - too much certificates, don't send root certificates 1 CN=fxpackage.com 2 CN=DST Root CA X3, O=Digital Signature Trust Co. 3 CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US ``` The root certificate is sent as the second certificate. Looks like sslshopper doesn't resort the certificates. So the error message is buggy. ---
**Author:** ![gamliel](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/gamliel/32/39394_2.png) [@gamliel](https://community.letsencrypt.org/u/gamliel)\ **Post date:** [May 7, 2020, 2:36pm UTC](https://community.letsencrypt.org/t/renewal-not-include-intermidiate/121600/17 "2020-05-07T14:36:28Z")
thanks about the info your amazing ---
**Author:** ![gamliel](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/gamliel/32/39394_2.png) [@gamliel](https://community.letsencrypt.org/u/gamliel)\ **Post date:** [May 7, 2020, 2:36pm UTC](https://community.letsencrypt.org/t/renewal-not-include-intermidiate/121600/18 "2020-05-07T14:36:56Z")
thanks for all you saved me appreciate all ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [June 6, 2020, 2:36pm UTC](https://community.letsencrypt.org/t/renewal-not-include-intermidiate/121600/19 "2020-06-06T14:36:57Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.