Certificate chain incomplete

#1

First, thanks for the app. It was quite helpful.

I created my cert and got it installed. To check it, i immediately went to Qualys SSL Labs to check to make sure everything was OK.

It reported that “This server’s certificate chain is incomplete.” A little more testing showed that it does seem to be incomplete.

What did I do wrong? I can’t find any option to include the cert chain.
How can I fix this?

Thanks!

#2

You might need to include what your environment looks like and what steps you took that might have been off the beaten path.

There should be three certificates in the chain.
1. [Your site]
2. Let’s Encrypt Authority X3
3. DST Root CA X3

I once did a custom implementation where I used OpenSSL to extract the certs and keys from a PFX, but forgot to tell it to include the chain… so the client knew the immediate cert, but didn’t know how to connect it to a CA that it trusted.

Once I realized that mistake and found the switch to use, the cert resolved correctly.

#3

I just went through the Certify interface. I didn’t make any strange selections and can’t see what different option I could have chosen.

Anybody else?

#4

Hi, this is not common which suggests something is not quite right. Is your server completely up to date with the latest windows updates? Certain certificates are maintained as a trusted list my microsoft, and it’s only in special cases that you would manually import new ones. It may also be that the server needs a reboot to clear cached certificate chains.

If it still isn’t right after updating and rebooting, try importing the certificate again using: Show Advanced Options > Other Options > Re-apply Certificate to Bindings, which will re-import the PFX and update the bindings again.

If that still doesn’t work try requesting the certificate again (although I don’t expect any difference from this).

#5

I just created a second certificate and everything worked fine this time, including the intermediate certificate. Why? I have no idea.

For the record:

  • Windows Updates: yes, of course, Windows Server 2016
  • This is one of a few servers responding to www.mydomain.com, but using DNS for authentication probably gets around this problem.
  • The first time I did it, the DNS authentication information was presented to me in a grayed out side panel where copying for pasting was not permitted. That was…confusing. I hope you find a better way to present that to people.
  • If I can help you troubleshoot something here, let me know.

But thanks everybody!

#6

@rebel glad it’s working OK now, occasionally glitches do happen at the operating system level that we can’t control and if that happens then restarting IIS or windows can be the solution, however such things are very rare.

Regarding multi-server hosting of a site, yes DNS authentication would be required currently. We’re looking at a way to combine CCS with shared challenge request config so that any server looking at a shared UNC path could answer http challenges for a given domain.

#7

To follow up, in putting this wildcard cert on other servers, one of the other servers had the same problem. I believe restarting the application pool (or something else) did the job.