# Unable to verify the first certificate on postman

**URL:** <https://discuss.elastic.co/t/unable-to-verify-the-first-certificate-on-postman/344071>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [September 28, 2023, 1:42pm UTC](https://discuss.elastic.co/t/unable-to-verify-the-first-certificate-on-postman/344071 "2023-09-28T13:42:53Z")\
**Posts on this page:** 1\
**Showing post:** 3

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [September 29, 2023, 6:32am UTC](https://discuss.elastic.co/t/unable-to-verify-the-first-certificate-on-postman/344071/3 "2023-09-29T06:32:46Z")

</div>

> [@stramzik](#):
>
> Both instances are secured with LetsEncrypt certificate

> [@stramzik](#):
>
> "Unable to verify the first certificate"

This seems to be the result of two things:

1. Postman doesn't trust the issuing certificate from Let's Encrypt
2. Your ES node is configured to only send the leaf certificate in the SSL handshake

The background info is here

- [Chain of Trust - Let's Encrypt](https://letsencrypt.org/certificates/)

Let's encrypt has an offline root cert, and a separate issuing certificate. That's very normal for a CA.

But what it means is that, if you:

1. Are using a tool (like Postman, or any other client) that trusts Let's Encrypt's root cert (technically, ISRG's root cert), but knows nothing of the issuing cert, _and_
2. Your server has a cert issued by the Let's Encrypt issuer, but does not include a copy of that issuing cert

then, when you point that tool at the server, there's no way for the 2 of them to connect-the-dots. The chain is broken because neither the client or the server has a copy of the intermediate issuing certificate.  
The tool trusts anything signed by ISRG, and the server has something that _is_ signed by ISRG, but the only way to know that is if you have a copy of the Let's Encrypt issuing cert (R3).

I don't know if there's a way to change #1 (make Postman know about the LE issuing cert), but you can fix #2 by grabbing the issuing cert (R3) from Let's Encrypt and adding it to the cert chain in your ES instance.

I assume your cert is signed by the R3 issuing cert from Let's Encrypt (there are other possibilities, but they're very unlikely). You can grab that cert from here

- [https://letsencrypt.org/certs/lets-encrypt-r3.pem](https://letsencrypt.org/certs/lets-encrypt-r3.pem)

To tell ES to use it, you just append it to the existing `.crt` file you're using.

Here's what you could do on a Linux server.  
It looks like you're using Windows, so you'll need to make some adjustments for your needs.

```auto
# Get the R3 cert from let's encrypt
curl -o ./lets-encrypt-r3.pem https://letsencrypt.org/certs/lets-encrypt-r3.pem

# Check that it downloaded correctly and looks like a PEM file with a
# -----BEGIN CERTIFICATE-----
# header, etc.
cat ./lets-encrypt-r3.pem

# Add it to the end of your cert chain
cat ./lets-encrypt-r3.pem >> config/certs/mydomain.com-crt.pem

```

---

_[View the full topic](https://discuss.elastic.co/t/unable-to-verify-the-first-certificate-on-postman/344071)._