# Error : Unable to load certificate chain

**URL:** <https://discourse.haproxy.org/t/error-unable-to-load-certificate-chain/5052>\
**Category:** Help!\
**Created:** [April 10, 2020, 8:47am UTC](https://discourse.haproxy.org/t/error-unable-to-load-certificate-chain/5052 "2020-04-10T08:47:30Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![vignesh-sp](https://avatars.discourse-cdn.com/v4/letter/v/9de0a6/32.png) [@vignesh-sp](https://discourse.haproxy.org/u/vignesh-sp)\
**Post date:** [April 10, 2020, 8:47am UTC](https://discourse.haproxy.org/t/error-unable-to-load-certificate-chain/5052/1 "2020-04-10T08:47:31Z")

</div>

I am trying to configure a backend with ssl, but it is failing with `Unable to load certificate chain` error.

This is a combined cert in the below format -

```
<PrivateKey>
<Cert>
<Cert>
<Cert>
<Cert>

```

When I try to reload with this config, it fails.

It works if I flip the format to -

```
<Cert>
<Cert>
<Cert>
<Cert>
<PrivateKey>

```

currently on HAproxy 2.1.3. When I add the cert in this format and reload the process, it works, but the cert format automatically flips back to -

```
<PrivateKey>
<Cert>
<Cert>
<Cert>
<Cert>

```

and the next reload will not work.

The same cert works in HAproxy 2.0.8 without any of the above problems.

I tested this 2.1.4 as well, the below format doesn’t work.

```
<PrivateKey>
<Cert>
<Cert>
<Cert>
<Cert>

```

The below works and stays the same even after the reload -

```
<Cert>
<Cert>
<Cert>
<Cert>
<PrivateKey>

```

My bad I’m repeating the format again and again, just wanted to be clear.

Can you guys shed some light on why the first format doesn’t work?

---

<div class="post-metadata">

**Author:** ![vignesh-sp](https://avatars.discourse-cdn.com/v4/letter/v/9de0a6/32.png) [@vignesh-sp](https://discourse.haproxy.org/u/vignesh-sp)\
**Post date:** [April 11, 2020, 2:38pm UTC](https://discourse.haproxy.org/t/error-unable-to-load-certificate-chain/5052/2 "2020-04-11T14:38:45Z")

</div>

Anyone?

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [April 12, 2020, 8:45pm UTC](https://discourse.haproxy.org/t/error-unable-to-load-certificate-chain/5052/3 "2020-04-12T20:45:17Z")

</div>

> [@vignesh-sp](#):
>
> When I add the cert in this format and reload the process, it works, but the cert format automatically flips back to -

The private key belongs to the end, however haproxy won’t ever write or modify certificate files.

So something is interfering in your reload process, modifying your certificate, but this has nothing todo with haproxy. I suggest you check your reload scripts (or unit files, if systemd is used).

---

<div class="post-metadata">

**Author:** ![vignesh-sp](https://avatars.discourse-cdn.com/v4/letter/v/9de0a6/32.png) [@vignesh-sp](https://discourse.haproxy.org/u/vignesh-sp)\
**Post date:** [April 13, 2020, 1:12am UTC](https://discourse.haproxy.org/t/error-unable-to-load-certificate-chain/5052/4 "2020-04-13T01:12:20Z")

</div>

@lukastribus thanks for the response. So should I always have the private key at the bottom? The same cert works in version 2.0.8.

Did something change in the newer versions?

Also have some backends with certs in below format, the work fine.

pkey  
cert  
cert  
cert.

The problem occurs when we have four certs and a key at the top.

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [April 13, 2020, 10:12pm UTC](https://discourse.haproxy.org/t/error-unable-to-load-certificate-chain/5052/5 "2020-04-13T22:12:43Z")

</div>

Why would you have four certificates in this file, I don’t understand the use-case. Do you have that many intermediate certificates you need to send to the client?

---

<div class="post-metadata">

**Author:** ![vignesh-sp](https://avatars.discourse-cdn.com/v4/letter/v/9de0a6/32.png) [@vignesh-sp](https://discourse.haproxy.org/u/vignesh-sp)\
**Post date:** [April 14, 2020, 1:50am UTC](https://discourse.haproxy.org/t/error-unable-to-load-certificate-chain/5052/6 "2020-04-14T01:50:26Z")

</div>

@lukastribus, no, I’m good. The cert is an an incorrect one. I am wondering why is it working in v2.0.8. Just curious !

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [April 14, 2020, 8:35am UTC](https://discourse.haproxy.org/t/error-unable-to-load-certificate-chain/5052/7 "2020-04-14T08:35:22Z")

</div>

I don’t know why it works in v2.0.8. To understand which exact change caused the difference in behavior, I would actually have to reproduce it and then bisect it to the change that caused the change in behavior, which is something that can be done if the behavior would actually be broken in the new release, but that doesn’t seem to be the case.