I have an iis server running let's encrypt certificates.
My problem is that iis isn't sending the full chain.
If test it with cert util it tell's me chain i ok why isn't iis sending it:
this is the output of certutil:
C:\>certutil -f -urlfetch -verify c:\test.cer Issuer: CN=Let's Encrypt Authority X3 O=Let's Encrypt C=US Name Hash(sha1): 7ee66ae7729ab3fcf8a220646c16a12d6071085d Name Hash(md5): c0350a4a6f6b94d938b5003a57bb4867 Subject: CN=exchange.dikkenberg.net Name Hash(sha1): 4f30e29655bd9659d59e782adbc718f53a1ac59e Name Hash(md5): b6a452fb8a6fdddda0c01afa2f05fbda Cert Serial Number: 036b6525c8bfb33446da50997b85c9bf36d0 dwFlags = CA_VERIFY_FLAGS_ALLOW_UNTRUSTED_ROOT (0x1) dwFlags = CA_VERIFY_FLAGS_IGNORE_OFFLINE (0x2) dwFlags = CA_VERIFY_FLAGS_FULL_CHAIN_REVOCATION (0x8) dwFlags = CA_VERIFY_FLAGS_CONSOLE_TRACE (0x20000000) dwFlags = CA_VERIFY_FLAGS_DUMP_CHAIN (0x40000000) ChainFlags = CERT_CHAIN_REVOCATION_CHECK_CHAIN (0x20000000) HCCE_LOCAL_MACHINE CERT_CHAIN_POLICY_BASE -------- CERT_CHAIN_CONTEXT -------- ChainContext.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100) SimpleChain.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100) CertContext[0][0]: dwInfoStatus=102 dwErrorStatus=0 Issuer: CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US NotBefore: 26-7-2016 19:39 NotAfter: 24-10-2016 19:39 Subject: CN=****** Serial: 036b6525c8bfb33446da50997b85c9bf36d0 SubjectAltName: DNS Name=******, DNS Name=******, DNS Name=******, DNS Name=******, DNS Name=******, DNS Name=******, DNS Name=******, DNS Name=******, DNS Name=******, DNS Name=******, DNS Name=******, DNS Name=****** 97c9018be613d951906d34887198f18545db8644 Element.dwInfoStatus = CERT_TRUST_HAS_KEY_MATCH_ISSUER (0x2) Element.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100) ---------------- Certificate AIA ---------------- Verified "Certificate (0)" Time: 0 [0.0] http://cert.int-x3.letsencrypt.org/ ---------------- Certificate CDP ---------------- No URLs "None" Time: 0 ---------------- Base CRL CDP ---------------- No URLs "None" Time: 0 ---------------- Certificate OCSP ---------------- No Signer "OCSP" Time: 0 [0.0] http://ocsp.int-x3.letsencrypt.org/ -------------------------------- CRL (null): Issuer: CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US ThisUpdate: 30-7-2016 20:00 NextUpdate: 6-8-2016 20:00 ecbecc733dc0d0f0d8f13e57ff88982de445d5d8 Issuance[0] = 2.23.140.1.2.1 Issuance[1] = 1.3.6.1.4.1.44947.1.1.1 Application[0] = 1.3.6.1.5.5.7.3.1 Server Authentication CertContext[0][1]: dwInfoStatus=102 dwErrorStatus=0 Issuer: CN=DST Root CA X3, O=Digital Signature Trust Co. NotBefore: 17-3-2016 18:40 NotAfter: 17-3-2021 18:40 Subject: CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US Serial: 0a0141420000015385736a0b85eca708 cb6c95d597fe6e192d2882339b502d065bb4a3e6 Element.dwInfoStatus = CERT_TRUST_HAS_KEY_MATCH_ISSUER (0x2) Element.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100) ---------------- Certificate AIA ---------------- Verified "Certificate (0)" Time: 4 [0.0] http://apps.identrust.com/roots/dstrootcax3.p7c ---------------- Certificate CDP ---------------- Verified "Base CRL (9e)" Time: 0 [0.0] http://crl.identrust.com/DSTROOTCAX3CRL.crl ---------------- Base CRL CDP ---------------- No URLs "None" Time: 0 ---------------- Certificate OCSP ---------------- Failed "OCSP" Time: 0 Error retrieving URL: The operation timed out 0x80072ee2 (INet: 12002 ERROR_ INTERNET_TIMEOUT) http://isrg.trustid.ocsp.identrust.com -------------------------------- CRL (null): Issuer: E=pki-ops@IdenTrust.com, CN=DST CA X3 OCSP Signer, OU=DST, O=Digital Signature Trust, C=US ThisUpdate: 2-8-2016 11:51 NextUpdate: 3-8-2016 11:51 ec243e50bf0890f22cde404c7776c7305af90fda Issuance[0] = 2.23.140.1.2.1 Issuance[1] = 1.3.6.1.4.1.44947.1.1.1 Application[0] = 1.3.6.1.5.5.7.3.4 Secure Email Application[1] = 1.3.6.1.5.5.7.3.1 Server Authentication CertContext[0][2]: dwInfoStatus=10c dwErrorStatus=0 Issuer: CN=DST Root CA X3, O=Digital Signature Trust Co. NotBefore: 30-9-2000 23:12 NotAfter: 30-9-2021 16:01 Subject: CN=DST Root CA X3, O=Digital Signature Trust Co. Serial: 44afb080d6a327ba893039862ef8406b 137cd76aca382673b15f9394dff6d8544f02c9da Element.dwInfoStatus = CERT_TRUST_HAS_NAME_MATCH_ISSUER (0x4) Element.dwInfoStatus = CERT_TRUST_IS_SELF_SIGNED (0x8) Element.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100) ---------------- Certificate AIA ---------------- No URLs "None" Time: 0 ---------------- Certificate CDP ---------------- No URLs "None" Time: 0 ---------------- Certificate OCSP ---------------- No URLs "None" Time: 0 -------------------------------- Application[0] = 1.3.6.1.5.5.7.3.4 Secure Email Application[1] = 1.3.6.1.5.5.7.3.1 Server Authentication Exclude leaf cert: 9386cd6fddbb5108141e8aa6de02e5076003bca2 Full chain: 274ef30f8b3ed9c701c5f6bc950782ffbf3927be ------------------------------------ Verified Issuance Policies: 2.23.140.1.2.1 1.3.6.1.4.1.44947.1.1.1 Verified Application Policies: 1.3.6.1.5.5.7.3.1 Server Authentication Cert is an End Entity certificate Leaf certificate revocation check passed CertUtil: -verify command completed successfully.