# SSL Zen "Failed verification" missing cabundle.crt **URL:** \ **Category:** Help\ **Created:** [May 12, 2021, 10:12pm UTC](https://community.letsencrypt.org/t/ssl-zen-failed-verification-missing-cabundle-crt/151584 "2021-05-12T22:12:53Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![fredcolclough](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/fredcolclough/32/49641_2.png) [@fredcolclough](https://community.letsencrypt.org/u/fredcolclough)\ **Post date:** [May 12, 2021, 10:12pm UTC](https://community.letsencrypt.org/t/ssl-zen-failed-verification-missing-cabundle-crt/151584/1 "2021-05-12T22:12:53Z")
Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. [crt.sh | example.com](https://crt.sh/?q=example.com)), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help. My domain is: [fredcolclough.com](http://fredcolclough.com) I ran this command: SSL Zen failed to provide all 3 cert files (cabundle.crt wouldn't download) It produced this output: Failed verification... HOW DO I GET MY CERTS SINCE cft.sh shows I DO have them! (and I've exceeded the # of certs that can be issued...so clearly I do have a cert, I just can't get it). My web server is (include version): Apache The operating system my web server runs on is (include version): Linux Mint 19.1 My hosting provider, if applicable, is: SELF I can login to a root shell on my machine (yes or no, or I don't know): YES I'm using a control panel to manage my site (no, or provide the name and version of the control panel): NO (other than Wordpress -- [fredcolclough.com/wpadmin](http://fredcolclough.com/wpadmin)) The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you're using Certbot): certbot fails. ---
**Author:** ![griffin](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/griffin/32/50204_2.png) [@griffin](https://community.letsencrypt.org/u/griffin)\ **Post date:** [May 12, 2021, 11:04pm UTC](https://community.letsencrypt.org/t/ssl-zen-failed-verification-missing-cabundle-crt/151584/2 "2021-05-12T23:04:05Z")
Welcome to the Let's Encrypt Community, Fred 🙂 While I don't know what to suggest to fix the problem with SSL Zen, as long as you still have your private keys saved in files, you can use their timestamps to pair them with your certificates here: [https://crt.sh/?q=fredcolclough.com](https://crt.sh/?q=fredcolclough.com) There's a download link "Download Certificate: PEM" on the left on each certificate's page. Be sure that the page says "Leaf certificate" and not "Precertificate" at the top. The certificates are listed in pairs (leaf certificate then precertificate). You can construct the "full chain" by downloading this intermediate certificate and adding it after your certificate in your certificate file: [https://letsencrypt.org/certs/lets-encrypt-r3.pem](https://letsencrypt.org/certs/lets-encrypt-r3.pem) then downloading this intermediate certificate and adding it after the previous intermediate certificate in your certificate file: [https://letsencrypt.org/certs/isrg-root-x1-cross-signed.pem](https://letsencrypt.org/certs/isrg-root-x1-cross-signed.pem) Alternatively (for now), you can download this intermediate certificate instead of the previous two and add it after your certificate in your certificate file: [https://letsencrypt.org/certs/lets-encrypt-r3-cross-signed.pem](https://letsencrypt.org/certs/lets-encrypt-r3-cross-signed.pem) The "CA Bundle" is either the first two intermediate certificates I mentioned (together) or the last intermediate certificate I mentioned (alone). Either way will work. ---
**Author:** ![fredcolclough](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/fredcolclough/32/49641_2.png) [@fredcolclough](https://community.letsencrypt.org/u/fredcolclough)\ **Post date:** [May 12, 2021, 11:15pm UTC](https://community.letsencrypt.org/t/ssl-zen-failed-verification-missing-cabundle-crt/151584/3 "2021-05-12T23:15:03Z")
Thanks for the quick reply. My apologies, I'm not completely following, but I think we're close! Can you elaborate on which piece goes into which piece? And filenames? I seem to have all the files, just not sure how to construct them. You say "...downloading this intermediate cert and adding it after "YOUR CERTIFICATE in your Certificate file"?? Which is 'my' cert file? If you could just spell it out a bit more I'm sure I'll get there! THANKS! ---
**Author:** ![griffin](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/griffin/32/50204_2.png) [@griffin](https://community.letsencrypt.org/u/griffin)\ **Post date:** [May 12, 2021, 11:17pm UTC](https://community.letsencrypt.org/t/ssl-zen-failed-verification-missing-cabundle-crt/151584/4 "2021-05-12T23:17:03Z")
To be honest, I first recommend that you create another certificate that covers **both** `fredcolclough.com` **and** `www.fredcolclough.com` instead of just `fredcolclough.com`. As it currently stands, your existing certificates will create a security hole. The crt.sh link I gave you above will be updated to include your new, expanded certificate within minutes of it being issued. ---
**Author:** ![fredcolclough](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/fredcolclough/32/49641_2.png) [@fredcolclough](https://community.letsencrypt.org/u/fredcolclough)\ **Post date:** [May 12, 2021, 11:19pm UTC](https://community.letsencrypt.org/t/ssl-zen-failed-verification-missing-cabundle-crt/151584/5 "2021-05-12T23:19:24Z")
The SSL ZEN plugin wouldn't let me add the 'www.' cert! So I went ahead without it. Plus I'm locked out of creating new certs because I didn't realize it was actually issuing them when it said "verification failed", so I have like a dozen... locked out for a week it appears. ---
**Author:** ![griffin](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/griffin/32/50204_2.png) [@griffin](https://community.letsencrypt.org/u/griffin)\ **Post date:** [May 12, 2021, 11:21pm UTC](https://community.letsencrypt.org/t/ssl-zen-failed-verification-missing-cabundle-crt/151584/6 "2021-05-12T23:21:01Z")
No problem. I'll clarify more. If you need a "full chain" certificate file, it needs to include your certificate (also known as the end-entity or leaf certificate) as well as any intermediate certificates necessary to verify your certificate. There are currently two options there: the first two intermediate certificates together that I mentioned above **or** the last intermediate certificate alone that I mentioned above. If you remove your certificate from the top of a "full chain" certificate file then that file is known as a "chain" certificate file or CA bundle file. ---
**Author:** ![griffin](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/griffin/32/50204_2.png) [@griffin](https://community.letsencrypt.org/u/griffin)\ **Post date:** [May 12, 2021, 11:22pm UTC](https://community.letsencrypt.org/t/ssl-zen-failed-verification-missing-cabundle-crt/151584/7 "2021-05-12T23:22:47Z")
You have five certificates, of that I can assure you. 🙂 If you click the crt.sh link I gave you above, it will look like you have ten. Every other certificate in that list is a precertificate, which is of no use to you. ---
**Author:** ![fredcolclough](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/fredcolclough/32/49641_2.png) [@fredcolclough](https://community.letsencrypt.org/u/fredcolclough)\ **Post date:** [May 12, 2021, 11:24pm UTC](https://community.letsencrypt.org/t/ssl-zen-failed-verification-missing-cabundle-crt/151584/8 "2021-05-12T23:24:45Z")
OK....so which file do I paste into the other file exactly? ---
**Author:** ![fredcolclough](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/fredcolclough/32/49641_2.png) [@fredcolclough](https://community.letsencrypt.org/u/fredcolclough)\ **Post date:** [May 12, 2021, 11:29pm UTC](https://community.letsencrypt.org/t/ssl-zen-failed-verification-missing-cabundle-crt/151584/9 "2021-05-12T23:29:42Z")
(I was following the Apache 2 install instructions, which utilized the three cert files) ---
**Author:** ![griffin](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/griffin/32/50204_2.png) [@griffin](https://community.letsencrypt.org/u/griffin)\ **Post date:** [May 12, 2021, 11:30pm UTC](https://community.letsencrypt.org/t/ssl-zen-failed-verification-missing-cabundle-crt/151584/10 "2021-05-12T23:30:10Z")
Put these three certificates into a single file (in this order) if you need the full chain in one file: [4511952634.pem](https://community.letsencrypt.org/uploads/short-url/j9qLOtBrkEtdNx50EkganF3qHyb.pem) (2.1 KB) [https://letsencrypt.org/certs/lets-encrypt-r3.pem](https://letsencrypt.org/certs/lets-encrypt-r3.pem) [https://letsencrypt.org/certs/isrg-root-x1-cross-signed.pem](https://letsencrypt.org/certs/isrg-root-x1-cross-signed.pem) * * * This is an alternate full chain: [4511952634.pem](https://community.letsencrypt.org/uploads/short-url/j9qLOtBrkEtdNx50EkganF3qHyb.pem) (2.1 KB) [https://letsencrypt.org/certs/lets-encrypt-r3-cross-signed.pem](https://letsencrypt.org/certs/lets-encrypt-r3-cross-signed.pem) * * * This is just your (leaf) certificate: [4511952634.pem](https://community.letsencrypt.org/uploads/short-url/j9qLOtBrkEtdNx50EkganF3qHyb.pem) (2.1 KB) * * * This is a CA bundle: [https://letsencrypt.org/certs/lets-encrypt-r3.pem](https://letsencrypt.org/certs/lets-encrypt-r3.pem) [https://letsencrypt.org/certs/isrg-root-x1-cross-signed.pem](https://letsencrypt.org/certs/isrg-root-x1-cross-signed.pem) * * * This is an alternate CA bundle: [https://letsencrypt.org/certs/lets-encrypt-r3-cross-signed.pem](https://letsencrypt.org/certs/lets-encrypt-r3-cross-signed.pem) ---
**Author:** ![griffin](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/griffin/32/50204_2.png) [@griffin](https://community.letsencrypt.org/u/griffin)\ **Post date:** [May 12, 2021, 11:34pm UTC](https://community.letsencrypt.org/t/ssl-zen-failed-verification-missing-cabundle-crt/151584/11 "2021-05-12T23:34:31Z")
In Apache2, you usually only need to specify the SSLCertificateFile with the full chain file as the parameter and the SSLCertificateKeyFile with the private key file as the parameter. The SSLCertificateChainFile directive is obsolete. If you have an older Apache2 version, specify the SSLCertificateFile with the leaf certificate file (with only your certificate) as the parameter and the SSLCertificateChainFile with a CA bundle file as the parameter. [https://httpd.apache.org/docs/current/mod/mod\_ssl.html](https://httpd.apache.org/docs/current/mod/mod_ssl.html) ---
**Author:** ![fredcolclough](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/fredcolclough/32/49641_2.png) [@fredcolclough](https://community.letsencrypt.org/u/fredcolclough)\ **Post date:** [May 12, 2021, 11:38pm UTC](https://community.letsencrypt.org/t/ssl-zen-failed-verification-missing-cabundle-crt/151584/12 "2021-05-12T23:38:13Z")
OK...so since Apache wants the three files: - **SSLCertificateFile** : This is your primary SSL certificate file (certificate.crt) - **SSLCertificateChainFile** : This is your CA-Bundle file (cabundle.crt) - **SSLCertificateKeyFile** : This is your private key file (privatekey.pem) and I'm missing the CA-bundle...I can simply combine: lets-encrypt-r3.pem with isrg-root-x1-cross-signed.pem? And call it "cabundle.cert"? Then complete the apache instructions? ---
**Author:** ![griffin](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/griffin/32/50204_2.png) [@griffin](https://community.letsencrypt.org/u/griffin)\ **Post date:** [May 12, 2021, 11:41pm UTC](https://community.letsencrypt.org/t/ssl-zen-failed-verification-missing-cabundle-crt/151584/13 "2021-05-12T23:41:48Z")
> [@fredcolclough](#): > > call it "cabundle.cert" should be `cabundle.crt` Otherwise, yep. 🙂 You got it. Just make sure that your certificate and private key match. By the way, I can pretty much guarantee that SSL Zen failed due to the recent chain change where the Let's Encrypt servers were serving this before: leaf signed by R3 R3 signed by DST Root CA X3 but are serving this now: leaf signed by R3 R3 signed by ISRG Root X1 ISRG Root X1 signed by DST Root CA X3 ---
**Author:** ![griffin](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/griffin/32/50204_2.png) [@griffin](https://community.letsencrypt.org/u/griffin)\ **Post date:** [May 12, 2021, 11:47pm UTC](https://community.letsencrypt.org/t/ssl-zen-failed-verification-missing-cabundle-crt/151584/14 "2021-05-12T23:47:28Z")
This is the official page with all the information and a diagram: > **[Chain of Trust - Let's Encrypt](https://letsencrypt.org/certificates/)** > > Last updated: Apr 29, 2021 > Root Certificates Our roots are kept safely offline. We issue end-entity certificates to subscribers from the intermediates in the next section. For additional compatibility as we submit our new Root X2 to various root... The "Subscriber Cert" is just yet another name for your Leaf certificate or End-Entity certificate. The intermediate certificate links that I gave you came from that page. ---
**Author:** ![griffin](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/griffin/32/50204_2.png) [@griffin](https://community.letsencrypt.org/u/griffin)\ **Post date:** [May 12, 2021, 11:53pm UTC](https://community.letsencrypt.org/t/ssl-zen-failed-verification-missing-cabundle-crt/151584/15 "2021-05-12T23:53:24Z")
Be sure to reload Apache once you've updated your configuration files! `sudo apachectl -k graceful` ---
**Author:** ![fredcolclough](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/fredcolclough/32/49641_2.png) [@fredcolclough](https://community.letsencrypt.org/u/fredcolclough)\ **Post date:** [May 13, 2021, 12:07am UTC](https://community.letsencrypt.org/t/ssl-zen-failed-verification-missing-cabundle-crt/151584/16 "2021-05-13T00:07:18Z")
Thanks. Working on it... ---
**Author:** ![griffin](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/griffin/32/50204_2.png) [@griffin](https://community.letsencrypt.org/u/griffin)\ **Post date:** [May 13, 2021, 12:10am UTC](https://community.letsencrypt.org/t/ssl-zen-failed-verification-missing-cabundle-crt/151584/17 "2021-05-13T00:10:04Z")
Out for dinner now. I'll be back later. 🙂 ---
**Author:** ![fredcolclough](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/fredcolclough/32/49641_2.png) [@fredcolclough](https://community.letsencrypt.org/u/fredcolclough)\ **Post date:** [May 13, 2021, 12:51am UTC](https://community.letsencrypt.org/t/ssl-zen-failed-verification-missing-cabundle-crt/151584/18 "2021-05-13T00:51:27Z")
I hope you enjoy dinner! When you're back... I have the added problem of my server suddenly stopped booting to the GUI.... so terminal is all I have. So I've been 'wget'ing the files you've posted since I can't launch a file explorer. I put the files where they're supposed to be... and made the edits in the apache2 instructions....still no go. Not sure where I went awry. I am having some difficulty with verbiage, as it's changing. The files you posted: - letsencrypt-r3.pem Is this what you're calling the "private key"? And which apache file is it? - isrg-root-x1-cross-signed.pem Which apache file is it? - 4511952634.pem Which apache file is it? I'll get there! Thx again. ---
**Author:** ![fredcolclough](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/fredcolclough/32/49641_2.png) [@fredcolclough](https://community.letsencrypt.org/u/fredcolclough)\ **Post date:** [May 13, 2021, 1:27am UTC](https://community.letsencrypt.org/t/ssl-zen-failed-verification-missing-cabundle-crt/151584/19 "2021-05-13T01:27:43Z")
....So I've tried multiple combinations of those files, to no avail. Not sure what I'm missing. Can you SSH in and take a look by chance? ---
**Author:** ![griffin](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/griffin/32/50204_2.png) [@griffin](https://community.letsencrypt.org/u/griffin)\ **Post date:** [May 13, 2021, 1:58am UTC](https://community.letsencrypt.org/t/ssl-zen-failed-verification-missing-cabundle-crt/151584/20 "2021-05-13T01:58:37Z")
I'm still enjoying... 🙂 but... The private key should be alone in a file provided by SSL Zen. Of all the files mentioned, the private key is the only one that you must keep secret. If you don't have it somewhere already, you will need to create a new certificate. That's why I said before that your certificate (or more specifically the public key in it) and the private key must match for anything to work. 4511952634.pem is your SSLCertificateFile letsencrypt-r3.pem followed by isrg-root-x1-cross-signed.pem in a single file is your SSLCertificateChainFile [Next page](https://community.letsencrypt.org/t/ssl-zen-failed-verification-missing-cabundle-crt/151584.md?page=2)