SSL Certificate Chain is Incomplete

younes89 · July 28, 2021, 7:39am

My SSL certificate chain is incomplete and all support articles are suggesting to install intermediate certificate chain.

Appreciate if you could help and guide me to solve this issue.

My domain is: chrisharis.com

I ran SSL Lab analysis on sllabs.com, which shows the below:

My web server is: OpenLite Speed (1.6.21)

The operating system my web server runs on: Ubuntu 20.04.2 LTS

My hosting provider is: AWS

I can login to a root shell on my machine.

The version of my client is: certbot 0.40.0

Thank You.

Osiris · July 28, 2021, 8:01am

How did you get and, more importantly, install the certificate into OpenLite Speed?

younes89 · July 28, 2021, 8:18am

Hi Osiris,

I have installed it following the steps in the below link:

maxi322 · July 28, 2021, 10:08am

Hello younes89,

it seems to me that your WebServer is not providing the full certificate chain, but instead only serves the "leaf" (your website certificate). In reality pretty much all modern browsers can ship around that issue because Let's Encrypt provides a Link to the intermediate Cert for the browser to download upon building the chain. But the better more complete solution is to serve all necessary certificates from your webserver.

Check if your used "fullchain.pem" and not "cert.pem" in your webserver configuration.

rg305 · July 28, 2021, 4:45pm

The link shows:

Did you follow that step?

younes89 · July 29, 2021, 6:19am

Hi @maxi322

Thanks for your response.

I have checked the webserver configuration, it's already configured to use fullchain.pem

Regards.

younes89 · July 29, 2021, 6:20am

Hi @rg305

Yes I did!

rg305 · July 29, 2021, 6:22am

hmm...

Then the problem is in the way it handles the fullchain.pem file.
Please show that file here [not to worry it contains only public information].

younes89 · July 29, 2021, 6:54am

Hi Rudy,

Thanks for your response again.
Attached the fullchain file.
fullchain.pem.txt (5.6 KB)

rg305 · July 29, 2021, 7:00am

OK try changing the order.
Moving the third cert to second place:

I suspect it either can't handle multiple Intermediates and is choosing the first one (or the last one) but can't build the trust path to that one.
If this test fails, we should try one Intermediate at a time (and see which one works).

younes89 · July 29, 2021, 7:18am

Changed the order with a graceful restart, tested it on ssllabs, but it's still showing the chain incomplete issue.

I will try with each one at a time...

younes89 · July 29, 2021, 8:18am

All tests reverted back with the same result!

Do you think it could be related to the chained certificate configuration in the web server?

maxi322 · July 29, 2021, 9:11am

Ok this gives it an interessting turn.

@younes89 Try the following:
Private Key File --> /etc/letsencrypt/live/chrisharis.com-0002/privkey.pem
Certificate File --> /etc/letsencrypt/live/chrisharis.com-0002/cert.pem
Chained Certificate --> /etc/letsencrypt/live/chrisharis.com-0002/chain.pem

younes89 · July 29, 2021, 9:35am

Thanks for your response @maxi322

I have tried the same, I don't get the option to set the Chained Certificate file path, but I selected 'Yes'. Tested the same on ssllabs and sslshopper, but no luck!

maxi322 · July 29, 2021, 9:49am

Ok, try to set "Chained Certificate" to yes and use the fullchain.pem on "Certificate File" again.

If that doesn't do it try to also set "CA Certificate Path" to chain.pem

younes89 · July 29, 2021, 10:04am

YESSSS, it worked!

fullchain.pem with chained certificate.

Thank you so much @maxi322 & @rg305 !!!

Osiris · July 29, 2021, 10:32am

Why would there be such a "Yes/No" option to begin with? What a strange control panel IMHO.....

system · August 28, 2021, 10:33am

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.