What is the difference between ca_chain.pem and chain.pem

Hi,

You did mention "client certificates" above, as @MikeMcQ pointed out, so we'd need to know more about what you are trying to achieve. Validating a client certificate requires trusting the issuer root, and that won't be Let's Encrypt (any more) as they will not be issuing certs with that key usage.

To get certificate components instead of the default PFX (PKCS#12) archive in Certify The Web you would add a deployment task under Tasks, normally the Deploy to Generic Server task is enough for most types of server that require pem files. Deployment Tasks | Certify The Web Docs

You seem to be asking for the root issuer certificate, which is quite unusual, but you can get a full export including a root (if known and present in the machine store) using the Export Certificate task and choosing Export As: PEM -Intermediate Certificate Chain + Root

The actual contents of a typical PEM chain file depend on the context but typically they are just intermediate CA certificates (not including the root). Note that PEM files are just text and they can be manipulated and concatenated in all manner of ways to suit different deployments using custom scripting (which you can again do as a Task).

For most common servers you can supply a "fullchain" file (which is your leaf cert plus intermediates, no root) and a private key file.

3 Likes