Continuing the discussion from Incomplete, Extra intermediate chain certificate:
I currently try to fix this by downloading https://letsencrypt.org/certs/lets-encrypt-r3-cross-signed.pem to my installation. I use acme-tiny and a custom shell script to let sign (acme-tiny), create the final certificate file and restart Apache server so I can half-automate it here. 
But SSLLabs still says the same missing cert in chain (R3). How can I fix my script?
#!/bin/sh
# Generates the cross-signed certificate with DH parameters and restarts web service
ACME_TINY_BIN="/var/www/letsencrypt/acme-tiny/acme_tiny.py"
ACCOUNT_KEY_FILE="/var/www/letsencrypt/account.key"
CHALLENGES_PATH="/var/www/letsencrypt/challenges/"
TEMP_PATH="/tmp/acme-tiny"
CERT_BASE_PATH="/etc/ssl/zulu289"
WWW_DATA_USER="www-data"
LETSENCRYPT_R3_PEM_FILE="/etc/ssl/certs/lets-encrypt-r3-cross-signed.pem"
TEMP_CERT_FILE="${TEMP_PATH}/signed.crt"
MAIL_NAME="mail"
MAIL_USER_GROUP="courier.postfix"
WWW_USER_GROUP="root.www-data"
if [ -z "$1" ]
then
echo "Usage: $0 <project>"
exit 1
elif [ ! -f "${ACME_TINY_BIN}" ]
then
echo "$0: acme-tiny client is missing. Aborting ..."
exit 255
elif [ ! -d "${TEMP_PATH}" ]
then
mkdir "${TEMP_PATH}"
fi
if [ ! -f "${LETSENCRYPT_R3_PEM_FILE}" ]
then
echo "$0: Cannot fine '${LETSENCRYPT_R3_PEM_FILE}', downloading ..."
wget https://letsencrypt.org/certs/lets-encrypt-r3-cross-signed.pem -O "${LETSENCRYPT_R3_PEM_FILE}"
chmod -c a+r "${LETSENCRYPT_R3_PEM_FILE}"
fi
CSR_FILE="${CERT_BASE_PATH}/$1.csr"
CERT_FILE="${CERT_BASE_PATH}/certs/$1.crt"
TARGET_PEM_FILE="${CERT_BASE_PATH}/certs/$1.pem"
if [ ! -f "${CSR_FILE}" ]
then
echo "$0: CSR file '${CSR_FILE}' does not exist."
exit 1
elif [ ! -f "${TARGET_PEM_FILE}" ]
then
echo "$0: Certificate file '${TARGET_PEM_FILE}' does not exist."
exit 1
fi
echo "$0: Running '${ACME_TINY_BIN}' ..."
sudo -u "${WWW_DATA_USER}" python ${ACME_TINY_BIN} --account-key "${ACCOUNT_KEY_FILE}" --csr "${CSR_FILE}" --acme-dir "${CHALLENGES_PATH}" > "${TEMP_CERT_FILE}" || exit 255
echo "$0: Copying certificate '${TARGET_PEM_FILE}' ..."
cp "${TEMP_CERT_FILE}" "${TARGET_PEM_FILE}"
echo "$0: Generating DH params ..."
openssl dhparam 2048 >> "${TARGET_PEM_FILE}" || exit 255
echo "$0: Fixing permissions ..."
chmod -c a+r "${TARGET_PEM_FILE}"
if [ "$1" = "${MAIL_NAME}" ]
then
chown -c ${MAIL_USER_GROUP} "${TARGET_PEM_FILE}" || exit 255
else
chown -c ${WWW_USER_GROUP} "${TARGET_PEM_FILE}" || exit 255
fi
if [ "$1" = "${MAIL_NAME}" ]
then
echo "$0: Attaching cert file ... (please fix)"
cat "${TEMP_CERT_FILE}" >> "${CERT_FILE}"
${EDITOR} "${CERT_FILE}"
echo "$0: Reloading Postfix/Courier ..."
service postfix restart
service courier-imap-ssl restart
/etc/init.d/courier-pop-ssl restart
else
echo "$0: Reloading Apache ..."
service apache2 reload
fi
echo "$0: Cleaning ..."
rm -f "${TEMP_CERT_FILE}"
echo "$0: All done."
exit 0
What am I doing wrong? acme-tiny is up-to-date:
GIT URL: https://github.com/diafygi/acme-tiny.git
Last commit: 0a9afb2b72bafad29d172f9d3d704ef979530fe3
Or am I having an abandoned project? I would love to stay with acme-tiny as it worked for several years by now.
PS: Didn't work with the updated version linked in ticket Add support for alternate chains · Issue #255 · diafygi/acme-tiny · GitHub
Edit: Updated script, removed X3 parts from it, fixed group name and courier-pop-ssl name
