This server's certificate chain is incomplete. Grade capped to B. openshift

Help
21

yep, that worked for me as I mentioned in post #17.

22

ssllabs is reporting an incomplete chain. I’ve tried both fullchain.pem and chain.pem with the same results. Any suggestions will be greatly appreciated.

23

can you guve a bit if information about your system ? apache ? gninx ? something else ? version ? website ?

24

I solved the issue, it was a case of fat finger syndrome combined with aging eyesight.

25

Incase anyone else stumbles across this I just installed certbot on a Debian Wheezy box with apache and had to use all three of:

        SSLCertificateKeyFile /etc/letsencrypt/live/[FQDN]/privkey.pem
        SSLCertificateChainFile /etc/letsencrypt/archive/[FQDN]/chain1.pem
        SSLCertificateFile /etc/letsencrypt/live/[FQDN]/fullchain.pem

as without the SSLCertificateChainFile the grade was also capped at B due to a reported incomplete chain.

26

@alasdair, if you want to specify a chain, a safer location would be /etc/letsencrypt/live/[FQDN]/chain.pem instead of pointing to the archive. (The way you did it, you won’t see the updates if the chain changes on renewal.)

It should not be necessary to use SSLCertificateChainFile anymore in current versions of Apache, as it’s now deprecated. Perhaps you’re running an older version of Apache or something?

27

alasdair19d : the SSLCertificateChainFile is obsolete since Apache 2.4.8 :

I recommand to read this documentation : How resolve This server’s certificate chain is incomplete

29

Just as a heads-up:
cert.pem contains your certificate.
chain.pem contains the intermediate certificate.
fullchain.pem contains both your certificate and the intermediate.

30

Shouldn’t you put /path-to/cert.pem in your SSLCertificateFile directive and /path-to/chain.pem in your SSLCertificateChainFile directive?

Isn’t SSLCACertificateFile supposed to be for client-side auth, and as such on some browsers like Chrome for Android could cause the browser to prompt for a client certificate?

31

Yes, it is. I don't know why someone had to necro a thread that had been dead for two years to add incorrect information.