# Still getting “A valid Root CA Certificate could not be located”
**URL:** https://community.letsencrypt.org/t/still-getting-a-valid-root-ca-certificate-could-not-be-located/193176
**Category:** Help
**Created:** [February 21, 2023, 5:20am UTC](https://community.letsencrypt.org/t/still-getting-a-valid-root-ca-certificate-could-not-be-located/193176 "2023-02-21T05:20:28Z")
**Posts on this page:** 12
**Page:** 1
### Author:  [@muzicman82](https://community.letsencrypt.org/u/muzicman82)
#### Post date: [February 21, 2023, 5:20am UTC](https://community.letsencrypt.org/t/still-getting-a-valid-root-ca-certificate-could-not-be-located/193176/1 "2023-02-21T05:20:28Z")
This is a report of the topic [here](https://community.letsencrypt.org/t/still-getting-a-valid-root-ca-certificate-could-not-be-located/182295), but I am still having this issue.
Hello,
I've been making certificates using win-acme. The web server is 4D. Validation is DNS with DreamHost.
Some SSL checkers say the certificate chain is fine and others report that a valid Root CA could not be located. Why? Geocerts is one of them.
Domain is [simon4d.bel.com](http://simon4d.bel.com/). Note that this is a different server entirely than [bel.com](http://bel.com/), but that hasn't mattered before.
I'm creating PEM files with the win-acme tool, and 4D uses the full chain and key files. I am not modifying them. There are no settings in 4D pertaining to SSL or management of certificates.
Can anyone view the domain's certificate and tell me what's going on? If it helps, there's a blank htm file [here](https://simon4d.bel.com/fetch.htm).
---
### Author:  [@rg305](https://community.letsencrypt.org/u/rg305)
#### Post date: [February 21, 2023, 5:24am UTC](https://community.letsencrypt.org/t/still-getting-a-valid-root-ca-certificate-could-not-be-located/193176/2 "2023-02-21T05:24:26Z")
SSL Labs reports:
```plaintext
Additional Certificates (if supplied)
Certificates provided 5 (6821 bytes)
Chain issues Incorrect order, Extra certs
```
---
### Author:  [@Bruce5051](https://community.letsencrypt.org/u/Bruce5051)
#### Post date: [February 21, 2023, 5:01pm UTC](https://community.letsencrypt.org/t/still-getting-a-valid-root-ca-certificate-could-not-be-located/193176/3 "2023-02-21T17:01:09Z")
> [@muzicman82](#):
>
> Can anyone view the domain's certificate and tell me what's going on?
Here [https://decoder.link/sslchecker/simon4d.bel.com/443](https://decoder.link/sslchecker/simon4d.bel.com/443), here [Hardenize: Comprehensive web site configuration test](https://www.hardenize.com/report/simon4d.bel.com/1676998615#www_certs), and here (as @rg305 has already pointed out) [SSL Server Test: simon4d.bel.com (Powered by Qualys SSL Labs)](https://www.ssllabs.com/ssltest/analyze.html?d=simon4d.bel.com&latest) all are stating " **Chain issues -Incorrect order, Extra certs**".
---
### Author:  [@muzicman82](https://community.letsencrypt.org/u/muzicman82)
#### Post date: [February 21, 2023, 7:11pm UTC](https://community.letsencrypt.org/t/still-getting-a-valid-root-ca-certificate-could-not-be-located/193176/4 "2023-02-21T19:11:57Z")
Right, but how do I resolve this? 4D has no settings or controls and the only instruction is to put the key.pem and cert.pem in the application directory.
The files are the exact PEM files from the win-acme script, just renamed. The cert is the full chain file, which is what we've used in the past. Should this not be the full chain file?
---
### Author:  [@Osiris](https://community.letsencrypt.org/u/Osiris)
#### Post date: [February 21, 2023, 7:23pm UTC](https://community.letsencrypt.org/t/still-getting-a-valid-root-ca-certificate-could-not-be-located/193176/5 "2023-02-21T19:23:43Z")
> [@muzicman82](#):
>
> Should this not be the full chain file?
That might be the case indeed. I have no experience with 4D (nor Windows for that matter), but seeing the chain is send _twice_, the solution _might_ be to use `cert.pem` instead of `fullchain.pem`: perhaps one of the two chains currently send disappears.
That said, even if one of the duplicate certs is removed, the final cert in the chain is still the ISRG Root X1 cert signed by the now expired DST Root CA X3 root certificate, i.e., the "Android compatibility chain" a.k.a. the "long chain". It might be the error does not go away even if just a single chain is send.
---
### Author:  [@Bruce5051](https://community.letsencrypt.org/u/Bruce5051)
#### Post date: [February 21, 2023, 7:51pm UTC](https://community.letsencrypt.org/t/still-getting-a-valid-root-ca-certificate-could-not-be-located/193176/6 "2023-02-21T19:51:30Z")
Also sound like [Verifying a certificate - #5 by jsha](https://community.letsencrypt.org/t/verifying-a-certificate/187233/5)
> [@Verifying a certificate](https://community.letsencrypt.org/t/verifying-a-certificate/187233/5):
>
> Here's an in-depth article about why: [Path Building vs Path Verifying: The Chain of Pain | by Ryan Sleevi | Medium](https://medium.com/@sleevi_/path-building-vs-path-verifying-the-chain-of-pain-9fbab861d7d6)
Perhaps choose different programs, ones that properly construct Paths and uses of Chains.
---
### Author:  [@jvanasco](https://community.letsencrypt.org/u/jvanasco)
#### Post date: [February 21, 2023, 8:00pm UTC](https://community.letsencrypt.org/t/still-getting-a-valid-root-ca-certificate-could-not-be-located/193176/7 "2023-02-21T20:00:45Z")
This interested me, so I did a quick online search.
1. Running SSL on that server requires a special plugin/library installed. Make sure it is installed.
2- All the tutorials and info I've read talk about `cert.pem` having a certificate - not a chain. This makes me wonder if it can support certificates signed by intermediaries, as supporting only a leaf certificate implies the server builds it's own trust path across known intermediates/roots. This wouldn't surprise me, because this server's documentation suggests it is mostly used in contexts where a self-signed or corporate certificate would be used - not a publicly trusted one.
For stuff like this, I find the only real option is to build out a test matrix of different possible combinations in a text document, and test them all - adding detailed notes to each one you tried.
e.g.
- Test Leaf Certificate only
- Test Leaf Certificate + [Intermediates,]
- Test Leaf Certificate + [Intermediates,] + Root
I would do this for each of the possible intermediate chains.
---
### Author:  [@Osiris](https://community.letsencrypt.org/u/Osiris)
#### Post date: [February 21, 2023, 8:02pm UTC](https://community.letsencrypt.org/t/still-getting-a-valid-root-ca-certificate-could-not-be-located/193176/8 "2023-02-21T20:02:51Z")
> [@jvanasco](#):
>
> 2- All the tutorials and info I've read talk about `cert.pem` having a certificate - not a chain. This makes me wonder if it can support certificates signed by intermediaries.
It might not support intermediates itself, but the service running behind port 443 _does_ send them.. Twice..
---
### Author:  [@webprofusion](https://community.letsencrypt.org/u/webprofusion)
#### Post date: [February 22, 2023, 3:29am UTC](https://community.letsencrypt.org/t/still-getting-a-valid-root-ca-certificate-could-not-be-located/193176/9 "2023-02-22T03:29:35Z")
The chain you have is:
`simon4d.bel.com ▶▶ R3 ▶▶ ISRG Root X1 ▶▶ R3 ▶▶ ISRG Root X1 ▶▶ [DST Root CA X3]` which looks to me like some confusion matching the intermediate vs root names.
Try setting the [Preferred Chain](https://www.win-acme.com/reference/settings) option to `ISRG Root X1` in your win-acme config and renew the cert to force the files to be rebuilt (there may be another way to regenerate the files in win-acme but I don't know it).
You may also consider just using a more common web server like IIS, nginx, caddy etc and reverse proxy that back to to your 4D site as http, if not ensure that you are always using the latest version of 4D because webservers are _constantly_ under attack while connected to the internet.
---
### Author:  [@jvanasco](https://community.letsencrypt.org/u/jvanasco)
#### Post date: [February 22, 2023, 3:30pm UTC](https://community.letsencrypt.org/t/still-getting-a-valid-root-ca-certificate-could-not-be-located/193176/10 "2023-02-22T15:30:22Z")
> [@webprofusion](#):
>
> You may also consider just using a more common web server like IIS, nginx, caddy etc and reverse proxy that back to to your 4D site as http, if not ensure that you are always using the latest version of 4D because webservers are _constantly_ under attack while connected to the internet.
This is **GREAT** advice, and this technique is very often used when a web server is either older or has limited support for Ciphers and/or TLS versions.
---
### Author:  [@Bruce5051](https://community.letsencrypt.org/u/Bruce5051)
#### Post date: [February 22, 2023, 3:51pm UTC](https://community.letsencrypt.org/t/still-getting-a-valid-root-ca-certificate-could-not-be-located/193176/11 "2023-02-22T15:51:39Z")
Possibly the 4D forum could be of assistance [Web server and https - English Community - 4D Forum](https://discuss.4d.com/t/web-server-and-https/25699)
and the 4D Doc Center also [Web Server, Overview](https://doc.4d.com/4Dv18/4D/18.4/Web-Server-Overview.300-5232832.en.html)
---
### Author:  [@system](https://community.letsencrypt.org/u/system)
#### Post date: [March 24, 2023, 3:51pm UTC](https://community.letsencrypt.org/t/still-getting-a-valid-root-ca-certificate-could-not-be-located/193176/12 "2023-03-24T15:51:58Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.