1

Summary

In summary I have some certificate related files and some certificate related instructions but I'm not sure which files are which !

Background

I've just installed a certificate from Lets Encrypt by using acme.sh

The output from that process looks like this :

[Sat Aug 18 02:50:24 UTC 2018] Your cert is in  /home/ubuntu/.acme.sh/www.foobar.xyz/www.foobar.xyz.cer
[Sat Aug 18 02:50:24 UTC 2018] Your cert key is in  /home/ubuntu/.acme.sh/www.foobar.xyz/www.foobar.xyz.key
[Sat Aug 18 02:50:24 UTC 2018] The intermediate CA cert is in  /home/ubuntu/.acme.sh/www.foobar.xyz/ca.cer
[Sat Aug 18 02:50:24 UTC 2018] And the full chain certs is there:  /home/ubuntu/.acme.sh/www.foobar.xyz/fullchain.cer

So after configuring Nginx this is all works when requests are made to https://www.foobar.xyz through a conventional browser.

Problem

But when I make the same request via Curl I get :

curl: (60) SSL certificate problem: unable to get local issuer certificate

So it seems there are two ways to fix this.

  • tell Curl to ignore the issue or provide curl with a client side list of certificating authorities.
  • alter the certificate on the server

Question

I want the second option, the change on the server, and this page gives instructions on how to do it specifically ...

2) If you received the intermediate certificates in one bundle file or downloaded the certificate files in your account with us, you can use this command:

cat example_com.crt bundle.crt >> ssl-bundle.crt

Place the concatenated file into the directory with SSL certificates on your Nginx server.

The problem I have is that I'm not sure which of the files produced by running acme.sh correspond to the example_com.crt and the bundle.crt ?

I think bundle.crt corresponds to www.foobar.xyz.cer ?

But I'm not sure what example_com.crt corresponds to ?

  • Aside: the names of files are irrelevant, only the content counts. You should name the files in such a way that they are clear to you what they contain. – Patrick Mevzek Aug 19 '18 at 3:13
1

The bundle is fullchain.cer. It contains ca.cer and www.foobar.xyz.cer.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.