Let's Encrypt: "unable to get issuer certificate" (error 2), forced reissuance and rate limits

Contribute Bug
6

For reference, the ACME client creates the following relevant files in ${LETSENCRYPT_DIR}:

  • ${DISCOURSE_HOSTNAME}.cer: contains the issued certificate
  • ca.cer: contains the certificate chain and is somewhat confusingly named
  • fullchain.cer: combines the above two files

The most correct command would be:

openssl verify -untrusted ca.cer ${DISCOURSE_HOSTNAME}.cer

The existing command is a little convoluted (and is incorrect as it doesn’t actually test the chain is valid to a system root), and anything else relies on side effects or assumptions.

I’ve extended the suggested change here:

https://github.com/discourse/discourse_docker/pull/1137

2 Likes