I'm having issues with setting up my certificate chain in Amazon ELB.

Error creating certificate Unable to validate certificate chain. The certificate chain must start with the immediate signing certificate, followed by any intermediaries in order. The index within the chain of the invalid certificate is: -1

From my certificate, how do I determine the immediate signing certificate using openssl?


You have to get them from your certificate issuer. All of them provide intermediate certificates. Usually they are attached to email which came with certificate, or you can download them directly from their website.

Where did you buy your certifcate ?

  • Yeah they don't exactly tell you. But I worked it out by asking a slightly different question.
    – hookenz
    Dec 14 '14 at 18:21
  • In my case issue was related with intermediate certificate which i was providing - it wasn't primary but secondary, and not SHA-1 but SHA-2 - i spent 30 minutes trying all possible combinations until it worked. bit painful process...
    – Slav
    Dec 18 '14 at 22:36
  • And what was the slightly different question @Matt
    – doublejosh
    Jan 5 '15 at 4:47
  • @doublejosh - look at comment under the question.
    – hookenz
    Jan 5 '15 at 18:25

It is important to note that the intermediate certificates are not specific to your domain or certificate. So, every certificate issued that is like yours, has the exact same intermediate certificates.

You can think of them a bit like the routing number on your checks. The routing number is needed, but really says more about your bank than it does about you. Your account number, or your certificate in this case, is what is unique to you.

Because of the generic nature of the intermediate certificates there are websites like this one:


That have all of the intermediate certificates pre-bundled (and in the correct order) for different certificate issuers.

  • Please don't post exactly the same answer multiple times. When applicable, leave a comment linking to your answer.
    – Sven
    May 22 '17 at 20:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.