title: Unable to `openssl verify' letsencrypt certificate
body: <p>I gererate a certificate with Letsencrypt using the Certbot container:</p>
  
  <pre><code>$ mkdir /home/$USER/letsencrypt
  $ docker run -it --rm -p 80:80 -p 443:443 -v /home/$USER/letsencrypt:/etc/letsencrypt certbot/certbot certonly --standalone --email user@example.com --agree-tos -d example.com
  </code></pre>
  
  <p>I navigate to the generated certificate:</p>
  
  <pre><code>$ cd /home/$USER/letsencrypt/live/example.com
  </code></pre>
  
  <p>I can verify <code>chain.pem</code>:</p>
  
  <pre><code>$ openssl verify chain.pem 
  chain.pem: OK
  </code></pre>
  
  <p>And I can see what's in <code>chain.pem</code>: </p>
  
  <pre><code>$ openssl x509 -noout -in chain.pem -subject -issuer
  subject=C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3
  issuer=O = Digital Signature Trust Co., CN = DST Root CA X3
  </code></pre>
  
  <p>I can't verify <code>cert.pem</code> (presumably because it needs the chain):</p>
  
  <pre><code>$ openssl verify cert.pem
  CN = example.com
  error 20 at 0 depth lookup: unable to get local issuer certificate
  error cert.pem: verification failed
  </code></pre>
  
  <p>But I also can't verify <code>fullchain.pem</code> either:</p>
  
  <pre><code>$ openssl verify fullchain.pem
  CN = example.com
  error 20 at 0 depth lookup: unable to get local issuer certificate
  error fullchain.pem: verification failed
  </code></pre>
  
  <p>The certificate seems to work in the browser, but is failing in <code>curl</code> (and an Android http client, which is the real issue):</p>
  
  <pre><code>$ curl https://example.com
  curl: (60) SSL certificate problem: unable to get local issuer certificate
  </code></pre>
  
  <p>I've double-checked that <code>fullchain.pem</code> is a concatenation of <code>cert.pem</code> and <code>chain.pem</code>.</p>
  
  <p>So: I don't understand why <code>fullchain.pem</code> doesn't verify?  </p>