title: OpenSSL use -CAFile on LetsEncrypt-Certificate
body: <p>I'm currently trying to set up a Confluence (6.6.0) on an Ubuntu Server with Plesk (17.5.3) and Let's-Encrypt-Extension installed.</p>
  
  <p>Confluence itself is up and running, but I am experiencing some issues, when it comes to SSL. Securing the Domain itself is easily done by just taking the "easy road" via the Plesk-Panel One-Click-Installer.</p>
  
  <p>The Certificates will be located at <code>/usr/local/psa/var/modules/letsencrypt/etc/archive/&lt;MY_DOMAIN&gt;/</code></p>
  
  <p>There are four .pem-files in this directory:</p>
  
  <ul>
  <li><code>cert1.pem</code></li>
  <li><code>chain1.pem</code></li>
  <li><code>fullchain1.pem</code></li>
  <li><code>privkey1.pem</code></li>
  </ul>
  
  <p>But now i need to tell Tomcat, that i have this certificate installed in the server.xml.<br>
  Since the Plesk-Let's-Encrypt-Extension saves the files as .pem-files i need to convert them via OpenSSL to be able to use the Java keytool.<br>
  I found a nice tutorial about this topic in general right here:<br>
  <a href="http://robblake.net/post/18945733710/using-a-pem-private-key-and-ssl-certificate-with" rel="nofollow noreferrer">http://robblake.net/post/18945733710/using-a-pem-private-key-and-ssl-certificate-with</a></p>
  
  <p>When i am trying the following, i get stuck at the very beginning, when i try to execute</p>
  
  <pre><code>openssl pkcs12 -export -in &lt;PATH&gt;/cert1.pem -inkey &lt;PATH&gt;/privkey1.pem -out foo.p12 -name tomcat -chain -CAFile &lt;PATH&gt;/chain1.pem
  </code></pre>
  
  <p>The command itself runs, when I am not using <code>-CAFile</code> and generates my .p12-File, but then throws a warning:</p>
  
  <pre><code>Error unable to get local issuer certificate getting chain.
  </code></pre>
  
  <p>If i try adding <code>-CAFile /usr/local/psa/var/modules/letsencrypt/etc/archive/&lt;MY_DOMAIN&gt;/chain1.pem</code> or using <code>[...]/fullchain1.pem</code> instead nothing will happen but OpenSSL printing the Usage-Documentation.</p>
  
  <p>So since these four .pem-files are the only ones available i'm not sure what else to do.</p>
  
  <p>Since i need the intermediate-certs too, i am wondering what i have to do here.</p>