# SSL Create Certificate Chain? **URL:** \ **Category:** Maker\ **Created:** [December 22, 2020, 12:29am UTC](https://forum.inductiveautomation.com/t/ssl-create-certificate-chain/41709 "2020-12-22T00:29:43Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![sungkhum](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/sungkhum/32/10636_2.png) [@sungkhum](https://forum.inductiveautomation.com/u/sungkhum)\ **Post date:** [December 22, 2020, 12:29am UTC](https://forum.inductiveautomation.com/t/ssl-create-certificate-chain/41709/1 "2020-12-22T00:29:43Z")
I've read the instructions here [https://www.inductiveautomation.com/resources/article/lets-encrypt-guide-for-ignition](https://www.inductiveautomation.com/resources/article/lets-encrypt-guide-for-ignition) I ended up using [https://www.win-acme.com/](https://www.win-acme.com/) (I'm on Windows) but I can't figure out how to create the root CA certificate from what is generated by Let's Encrypt. Specifically the part that says: > As of the time of this writing, Let’s Encrypt is using [DST Root CA X3](https://www.identrust.com/dst-root-ca-x3) as the root CA cert. Copy its contents to a .pem file in a well-known location on your server and let’s reference it as **$ROOT\_CA\_CERT** in this document. Would anyone be able to give some help on this? Thanks! ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/b/0/b03cc3c9c886bf6cbc88db7c2969dc294ceb802b.png) ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [December 22, 2020, 3:55am UTC](https://forum.inductiveautomation.com/t/ssl-create-certificate-chain/41709/2 "2020-12-22T03:55:37Z")
Concatenate the PEM files. In signing order (root last). ---
**Author:** ![sungkhum](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/sungkhum/32/10636_2.png) [@sungkhum](https://forum.inductiveautomation.com/u/sungkhum)\ **Post date:** [December 22, 2020, 6:50pm UTC](https://forum.inductiveautomation.com/t/ssl-create-certificate-chain/41709/3 "2020-12-22T18:50:38Z")
Thanks. So I figured out that I can download the root (missed that before) from here: [https://www.identrust.com/dst-root-ca-x3](https://www.identrust.com/dst-root-ca-x3) But when I concatenate the pem files (with that root one at the bottom) it gives the error: A duplicate certificate was detected If I just concatenate the chain-only with the root it gives the error: Unable to verify the certificate chain of trust Am I using the wrong root file? ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [December 22, 2020, 6:54pm UTC](https://forum.inductiveautomation.com/t/ssl-create-certificate-chain/41709/4 "2020-12-22T18:54:32Z")
Try just the root file in that last box. You might only have a three-level complete chain. Or otherwise exclude what you put in the other boxes. ---
**Author:** ![sungkhum](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/sungkhum/32/10636_2.png) [@sungkhum](https://forum.inductiveautomation.com/u/sungkhum)\ **Post date:** [December 22, 2020, 7:00pm UTC](https://forum.inductiveautomation.com/t/ssl-create-certificate-chain/41709/5 "2020-12-22T19:00:30Z")
Ah, a few things were wrong on my end. I needed to specify Acme.PreferredIssuer to be “ISRG Root X1” in settings.json for WIN-ACME and download that X1 pem from [https://letsencrypt.org/certificates/](https://letsencrypt.org/certificates/) and then yes, I just needed the root in that last box, nothing concatenated. Thanks for your help!