Serve the full certificate chain on Apache
Why it matters
The server sends its own certificate but not the intermediate certificate that links it to a trusted authority. Some browsers can fetch the missing piece, but many apps, command-line tools and mobile clients cannot and will refuse the connection.
The fix
- From Apache 2.4.8 the intermediates can be in the SSLCertificateFile itself, so point it at fullchain.pem. Older versions need SSLCertificateChainFile as well.
- Test the configuration and reload Apache.
/
SSLCertificateFile /etc/letsencrypt/live/example.com/fullchain.pem SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem
The examples use example.com. Replace it with your own domain.
Related
- Reported by the certificate chain and expiry check
- Renew the expired TLS certificate
- Fix a certificate that is not valid yet
- Renew the certificate before it expires
- Install a certificate that covers this hostname
- Replace the self-signed certificate with a trusted one
- Use a certificate from a publicly trusted authority
- Replace the expired intermediate certificate
- Re-issue the certificate with a stronger key
- Replace the certificate that uses a broken hash
- Fix the certificate that browsers reject
Scan your domain to see whether this applies to you.