Old versions of apache don't support combined chain files

[SwartzCr]

Maybe we should mention this for people on old versions of 2.4
via: https://community.letsencrypt.org/t/curl-refuses-to-accept-my-cert-saying-the-certificate-issuer-is-not-recognized/40917

[jemacom]

Where can I find the doc file to change ?

[SwartzCr]

Hi @jemacom!
The file to change would be https://github.com/certbot/certbot/blob/master/docs/using.rst
Note that that's a rst file that will be built by sphinx, and as such has some strange formatting. You can read more about rst formatting syntax here: http://docutils.sourceforge.net/docs/user/rst/quickstart.html and here http://docutils.sourceforge.net/docs/user/rst/cheatsheet.txt
Let me know if you have any issues getting started!

[jemacom]

Hi @SwartzCr,

I think someone already worked on this version problem here.

Should I mention it elsewhere in the docs ? If yes, in which section ?

Thanks ! 😊

[sbraden]

Pycon2018 Sprint: In progress.

[sbraden]

The relevant documentation is already in the docs/using.rst file:
(starting on line 712)
`
fullchain.pem
All certificates, including server certificate (aka leaf certificate or
end-entity certificate). The server certificate is the first one in this file,
followed by any intermediates.

This is what Apache >= 2.4.8 needs for SSLCertificateFile <https://httpd.apache.org/docs/2.4/mod/mod_ssl.html#sslcertificatefile>,
and what Nginx needs for ssl_certificate <http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_certificate>.

cert.pem and chain.pem (less common)
cert.pem contains the server certificate by itself, and
chain.pem contains the additional intermediate certificate or
certificates that web browsers will need in order to validate the
server certificate. If you provide one of these files to your web
server, you must provide both of them, or some browsers will show
"This Connection is Untrusted" errors for your site, some of the time <https://whatsmychaincert.com/>_.

Apache < 2.4.8 needs these for SSLCertificateFile <https://httpd.apache.org/docs/2.4/mod/mod_ssl.html#sslcertificatefile>.
and SSLCertificateChainFile <https://httpd.apache.org/docs/2.4/mod/mod_ssl.html#sslcertificatechainfile>,
respectively.
`

[bmw]

Nice catch. I think this can be closed.

Thanks for looking into this!