# This server's certificate chain is incomplete. Grade capped to B

**URL:** <https://community.letsencrypt.org/t/this-servers-certificate-chain-is-incomplete-grade-capped-to-b/99619>\
**Category:** Help\
**Created:** [August 11, 2019, 12:04am UTC](https://community.letsencrypt.org/t/this-servers-certificate-chain-is-incomplete-grade-capped-to-b/99619 "2019-08-11T00:04:38Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![ITCrowd](https://avatars.discourse-cdn.com/v4/letter/i/13edae/32.png) [@ITCrowd](https://community.letsencrypt.org/u/ITCrowd)\
**Post date:** [August 11, 2019, 12:04am UTC](https://community.letsencrypt.org/t/this-servers-certificate-chain-is-incomplete-grade-capped-to-b/99619/1 "2019-08-11T00:04:38Z")

</div>

Hi

**TL;DR:** Cert installed. When checked, I'm informed that "the server's certificate chain is incomplete. Grade capped to B". How to get grade A?

I had some problems with setting up a cert for a domain using LE (I'd reached my weekly limit...) so I tried using [SSLForFree](https://www.sslforfree.com/) (which uses LE) and managed to get 'another roll of the dice' (I was allowed to create one cert).

I now have the following files

`-rw-r--r-- 1 root root 1646 Aug 10 18:43 ca_bundle.crt`  
`-rw-r--r-- 1 root root 1930 Aug 10 18:43 certificate.crt`  
`-rw-r--r-- 1 root root 1703 Aug 10 18:43 private.key`

Two files are successfully installed following [instructions](https://www.youtube.com/watch?v=orF39piVlIc) at SSLForFree:

`SSLCertificateFile /etc/httpd/certs/example.com/certificate.crt`  
`SSLCertificateKeyFile /etc/httpd/certs/example.com/private.key`

The server/cert works but on checking with [SSLLabs](https://www.ssllabs.com/ssltest/analyze.html), I get the following message:

> This server's certificate chain is incomplete. Grade capped to B.

The Grade B status produces warning messages in some browsers which I want to avoid.

What do I need to do to get the cert to pass at Grade A? Do I need to concatenate the .crt files and .key to form .pem files? What needs to be concatenated with what to create the standard set of three LE files as follows:

`SSLCertificateFile /etc/letsencrypt/live/example.com/cert.pem`  
`SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem`  
`SSLCertificateChainFile /etc/letsencrypt/live/example.com/chain.pem`

Many thanks in advance.

- My web server is: Apache/2.2.15 (Unix)
- The operating system my web server runs on is: **Centos 6**
- My hosting provider: **self-hosted**
- I can login to a root shell on my machine: **yes**
- I'm using a control panel to manage my site: **no**
- The version of my client is: **certbot 0.37.1**

---

<div class="post-metadata">

**Author:** ![\_az](https://avatars.discourse-cdn.com/v4/letter/_/22d042/32.png) [@\_az](https://community.letsencrypt.org/u/_az)\
**Post date:** [August 11, 2019, 12:16am UTC](https://community.letsencrypt.org/t/this-servers-certificate-chain-is-incomplete-grade-capped-to-b/99619/2 "2019-08-11T00:16:03Z")

</div>

Your `ca_bundle.crt` probably correlates with Certbot’s `chain.pem`, so try using that with `SSLCertificateChainFile`.

---

<div class="post-metadata">

**Author:** ![ITCrowd](https://avatars.discourse-cdn.com/v4/letter/i/13edae/32.png) [@ITCrowd](https://community.letsencrypt.org/u/ITCrowd)\
**Post date:** [August 11, 2019, 8:25am UTC](https://community.letsencrypt.org/t/this-servers-certificate-chain-is-incomplete-grade-capped-to-b/99619/3 "2019-08-11T08:25:05Z")

</div>

Thanks @_az - I’ll give that a try and report back. Fingers crossed…

---

<div class="post-metadata">

**Author:** ![ITCrowd](https://avatars.discourse-cdn.com/v4/letter/i/13edae/32.png) [@ITCrowd](https://community.letsencrypt.org/u/ITCrowd)\
**Post date:** [August 11, 2019, 8:54pm UTC](https://community.letsencrypt.org/t/this-servers-certificate-chain-is-incomplete-grade-capped-to-b/99619/4 "2019-08-11T20:54:43Z")

</div>

Thanks @_az - that worked and checked out with an A grade. Thanks a million. 🍻

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\
**Post date:** [September 10, 2019, 8:54pm UTC](https://community.letsencrypt.org/t/this-servers-certificate-chain-is-incomplete-grade-capped-to-b/99619/5 "2019-09-10T20:54:44Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.