Answer the question
In order to leave comments, you need to log in
`
Not trusting let`s encrypt certificate?
Until that time, I thought that cert.pem and privkey.pem were the only files to install until I looked at the site on mobile and little-known browsers, they simply do not trust the certificate, So I think that the other two files that are loaded when receiving a certificate via certboot organize the "path" trust on which it is possible to check authenticity of the certificate by the browser? correct me if I'm wrong!
Answer the question
In order to leave comments, you need to log in
The site (TLS server in general) must itself provide a full chain of certificates confirming its own, excluding the root CA certificate, which is normally in the trust store on the client. So yes, in addition to cert.pem, you also need to give fullchain.pem. The reason is that the client normally does not need to know about the entire PKI infrastructure of each CA whose root certificate it holds, since it is generally dynamic, and subordinate certificates are still reissued every 1-5 years (LE with its three-month certificates may change subCA once a year), so the client has nowhere to get the entire chain of certificates. Therefore, the most logical solution is to store it on the server, since he must also know who signed the certificate for him, and distribute it from the server as needed.
Often you need to register intermediate CA certificates, then mobile devices will not throw out the warning
cert.pem and privkey.pem are the only files
Didn't find what you were looking for?
Ask your questionAsk a Question
731 491 924 answers to any question