SSL Certificate Chain Incomplete

1
votes

Can someone please explain what exactly the SSL Labs test's "This server's certificate chain is incomplete" means and how to fix it? Exact steps of what I did

  1. Generate Let's Encrypt certificate via the Let's Encrypt client using the standalone module (./letsencrypt-auto --standalone)
  2. This yielded 4 files: cert1.pem, chain1.pem, fullchain1.pem, privkey1.pem
  3. Generate PKCS12 file to import the certificate:

openssl pkcs12 -export -in cert1.pem -inkey privkey1.pem -out cert_and_key.p12 -name certificate -CAfile fullchain1.pem -caname root

  1. Create the keystore:

keytool -importkeystore -deststorepass Pas5w0rd123 -destkeypass Pas5w0rd123 -destkeystore cert.jks -srckeystore cert_and_key.p12 -srcstoretype PKCS12 -srcstorepass Pas5w0rd123 -alias cert

keytool -import -trustcacerts -alias root -file chain1.pem -keystore cert.jks

  1. Now using the created cert.jks on a server and having it tested with SSL Labs, the SSL test reports this problem: "This server's certificate chain is incomplete.".

Thanks very much in advance for your answers!

1
javasslencryptionssl-certificatekeytool
Most likely means the root is not in SSL Labs trust package. Do they include the Let's Encrypt root cert? - stark

1 Answers

1
votes

It seems that in certificate chain is missing the certificate Let's Encrypt Authority X3.

Check that your pkcs12 really contains the private key, the public key and the certification chain. The best option is to use the GUI portecle (http://portecle.sourceforge.net/)

When creating the pkcs12 '-CAfile fullchain1.pem' should be '-certfile fullchain1.pem'.