# ECE 2.0.1 Unable to upload Letsencrypt TLS certificate

**URL:** <https://discuss.elastic.co/t/ece-2-0-1-unable-to-upload-letsencrypt-tls-certificate/158802>\
**Category:** Elastic Cloud Enterprise (ECE)\
**Created:** [November 29, 2018, 5:28pm UTC](https://discuss.elastic.co/t/ece-2-0-1-unable-to-upload-letsencrypt-tls-certificate/158802 "2018-11-29T17:28:42Z")\
**Posts on this page:** 1\
**Showing post:** 4

<div class="post-metadata">

**Author:** ![Alex\_Piggott](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alex_piggott/32/11053_2.png) [@Alex\_Piggott](https://discuss.elastic.co/u/Alex_Piggott)\
**Post date:** [November 29, 2018, 8:18pm UTC](https://discuss.elastic.co/t/ece-2-0-1-unable-to-upload-letsencrypt-tls-certificate/158802/4 "2018-11-29T20:18:41Z")

</div>

Despite its name, I'm not convinced `fullchain.pem` includes the CA cert, can you double check? If not, try converting/`cat`ing that in

Otherwise you should be able to use `openssl` to verify the combined PEM is valid (or if not, what's wrong with it), eg:

Let's assume the following values are set:

```auto
SRV_KEY=[path to server RSA key]
SRV_CERT=[path to server X509 cert]
INTER_CERT=[path to intermediate CA X509 cert]
CA_CERT=[path to CA X509 cert]
CHAIN=[path to certificate chain, eg cat $SRV_KEY $SRV_CERT $INTER_CERT $CA_CERT > $CHAIN]

```

To verify the server key matches the cert (eg to avoid `[Key Mismatch: public key in server certificate doesn't match public key part of PKCS1 RSA private key]`), run:

```auto
openssl rsa -noout -modulus -in ${SRV_KEY} | openssl sha256
> (stdin)= 3da7dff874ae18e4529667339ada88e9ef17adb793cff6cf92f500e09af72879

openssl x509 -noout -modulus -in ${SRV_CERT} | openssl sha256
> (stdin)= 3da7dff874ae18e4529667339ada88e9ef17adb793cff6cf92f500e09af72879

```

And make sure the two outputs match (this will be a value other than `3da7dff...` for your cert and key).

To check that the cert chain is valid, run:

```auto
openssl verify -CAfile ${CA_CERT} -untrusted ${INTER_CERT} ${CHAIN}

> ${CHAIN}: OK

```

To debug an invalid cert chain, grab the subject and issuer for each cert and make sure they match the next cert:  
The **issuer** for the server cert (`issuer=C = US, ST = California, O = Stu Test, CN = Stu Test Intermediate CA`)...

```auto
openssl x509 -subject -issuer -noout -in ${SRV_CERT}

> subject=CN = *.stu.example.com
> issuer=C = US, ST = California, O = Stu Test, CN = Stu Test Intermediate CA

```

...should match the **subject** for the intermediate cert (`subject=C = US, ST = California, O = Stu Test, CN = Stu Test Intermediate CA`).

Next, the **issuer** (`issuer=C = US, ST = California, O = Stu Test, CN = Stu Test CA`) for the **intermediate cert**...

```auto
openssl x509 -subject -issuer -noout -in ${INTER_CERT}

> subject=C = US, ST = California, O = Stu Test, CN = Stu Test Intermediate CA
> issuer=C = US, ST = California, O = Stu Test, CN = Stu Test CA

```

...should match the **subject** for the **CA cert**.

```auto
openssl x509 -subject -issuer -noout -in ${CA_CERT}

> subject=C = US, ST = California, O = Stu Test, CN = Stu Test CA
> issuer=C = US, ST = California, O = Stu Test, CN = Stu Test CA

```

CA certs are self signed, so the subject is the issuer.

---

_[View the full topic](https://discuss.elastic.co/t/ece-2-0-1-unable-to-upload-letsencrypt-tls-certificate/158802)._