Let's Encrypt certificate chain is invalid

[Turab]

Hi all.

I have searched this for hours but can't find a solution. I am using AdGuard container through Caprover and obtained an SSL from Let's Encrypt from it. Then I hard linked certificate files to the AdGuard container's persistent volume. When I save the file path, it reads certificate and the key correctly. It says the key is valid. It shows everything about the certificate correctly, but still says the chain is invalid.

I saw some people resolved this issue by appending root CA certificate manually to /etc/ssl/certs/ca-certificates.crt

I tried this and it still doesn't work. What should I do?

[jsanagustin]

Adguard's instructions indicate that one should specify a preferred chain. Could this be the problem?

https://github.com/AdguardTeam/AdGuardHome/wiki/Encryption#get-a-certificate-using-dns-challenge

[Turab]

Looks like it doesn't read the root certificate from the chain (ca-certificates.crt). Pointing to fullchain.pem instead of cert.pem worked. Thank you. But.. it still doesn't work on Android.

I put "dns.adguard.com" to private DNS on my phone and it works (although from time to time it stops working and it displays a notification that private DNS can not be connected). But when I put my AdGuard Home address like dns.example.com it instantly says it can't connect. I thought SSL error was the problem but turns out SSL is not the problem here.