I am running my own RocketChat latest version on Docker. And on top of it I have Nginx as a reverse proxy running Certbot to do a https. It works perfectly fine with Firefox web browser on Android and Chrome on OSX. However, when I use its own Android mobile app. I can not connect to my server.

I found the issue with same error message. The conclusion is related to certificate. Therefore I check my own server and it has ROOT 1 missing. After read the article. I have 2 questions as follows

Nginx Configuration:

upstream chat {
  server localhost:3000;

server {
    listen 80 ;
    listen [::]:80 ;
    server_name chat.elcolie.com ;

    root /var/www/html;
    location ~ /.well-known{
        allow all;
    location / {
       return 301 https://$server_name$request_uri;

server {
    listen 443 ssl ;
    listen [::]:443 ssl;
    include snippets/ssl-elcolie.com.conf;
    include snippets/ssl-params.conf;

    server_name chat.elcolie.com;

    location / {
            proxy_pass                 http://chat;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
            proxy_set_header Host $http_host;

            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forward-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forward-Proto http;
            proxy_set_header X-Nginx-Proxy true;

            proxy_redirect off;


ssl_certificate /etc/letsencrypt/live/elcolie.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/elcolie.com/privkey.pem;
ssl_trusted_certificate /etc/letsencrypt/live/elcolie.com/chain.pem;


ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_ecdh_curve secp384r1;
ssl_session_cache shared:SSL:10m;
ssl_session_tickets off;
ssl_stapling on;
ssl_stapling_verify on;
resolver valid=300s;
resolver_timeout 5s;
# disable HSTS header for now
#add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
#add_header X-Frame-Options DENY;
add_header X-Frame-Options SAMEORIGIN;
add_header X-Content-Type-Options nosniff;

ssl_dhparam /etc/ssl/certs/dhparam.pem;


Adding fullchain.pem by letsencryptauthorityx3.pem Then sslchecker return me same thing. Root 1 missing My server is chat.elcolie.com

Root 1 missing


Download DST Root CA X3 certificate in p7b format And extract by command in the bcarroll answer

All green

Tomorrow I will find Android & iOS to confirm this setup


Rocket.Chat Android is not be able to login to my server


  1. How do I get Android mobile app works with my server?

  2. Do I need to buy the other certificate to solve this problem?

enter image description here


You need to download and install this root certificate on the server. You do not need to get other certificate.

The case is Let's Encrypt root certificate is not included (usually) in some OS, but it is signed by other trusty CAs.

  • Do you mean I have put ISRG Root X1 (self-signed) from letsencrypt.org/certificates ? After download what am I going to do next? my nginx has running certbot and it takecares of fullchain.pem and privkey.pem already? – Sarit Feb 11 at 17:55
  • Obviously nginx do not add the root certificate. No, you need to add DST Root CA X3 certificate. You should add it on last place in the file where is your certificate (and restart nginx) – Romeo Ninov Feb 11 at 18:13

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.