# Let's Encrypt: "unable to get issuer certificate" (error 2), forced reissuance and rate limits

**URL:** <https://meta.discourse.org/t/lets-encrypt-unable-to-get-issuer-certificate-error-2-forced-reissuance-and-rate-limits/414167>\
**Category:** Bug\
**Tags:** letsencrypt\
**Created:** [October 7, 2026, 5:05pm UTC](https://meta.discourse.org/t/lets-encrypt-unable-to-get-issuer-certificate-error-2-forced-reissuance-and-rate-limits/414167 "2026-10-07T17:05:24Z")\
**Posts on this page:** 1\
**Showing post:** 6

<div class="post-metadata">

**Author:** ![supermathie](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/supermathie/32/507518_2.png) [@supermathie](https://meta.discourse.org/u/supermathie)\
**Post date:** [October 13, 2026, 2:11pm UTC](https://meta.discourse.org/t/lets-encrypt-unable-to-get-issuer-certificate-error-2-forced-reissuance-and-rate-limits/414167/6 "2026-10-13T14:11:53Z")

</div>

For reference, the ACME client creates the following relevant files in `${LETSENCRYPT_DIR}`:

- `${DISCOURSE_HOSTNAME}.cer`: contains the issued certificate
- `ca.cer`: contains the certificate chain and is somewhat confusingly named
- `fullchain.cer`: combines the above two files

The most correct command would be:

```plaintext
openssl verify -untrusted ca.cer ${DISCOURSE_HOSTNAME}.cer

```

The existing command is a little convoluted (and is incorrect as it doesn’t actually test the chain is valid to a system root), and anything else relies on side effects or assumptions.

I’ve extended the suggested change here:

[https://github.com/discourse/discourse\_docker/pull/1137](https://github.com/discourse/discourse_docker/pull/1137)

---

_[View the full topic](https://meta.discourse.org/t/lets-encrypt-unable-to-get-issuer-certificate-error-2-forced-reissuance-and-rate-limits/414167)._