# Correct order from combine certificates **URL:** \ **Category:** Traefik v1\ **Tags:** docker-swarm\ **Created:** [January 26, 2021, 5:03pm UTC](https://community.traefik.io/t/correct-order-from-combine-certificates/9460 "2021-01-26T17:03:03Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![empereira](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/empereira/32/3266_2.png) [@empereira](https://community.traefik.io/u/empereira)\ **Post date:** [January 26, 2021, 5:03pm UTC](https://community.traefik.io/t/correct-order-from-combine-certificates/9460/1 "2021-01-26T17:03:03Z")
Hello, We use an ICPEDU institutional certificate that is part of GlobalSIgn. In traefik we are using only the \*.company.org certificate and the key. Doing tests on sslabs, informs that the chain of certificates is incomplete. ![image](https://us1.discourse-cdn.com/flex020/uploads/containo/original/2X/3/3f61f34cf73bb2ed805c6a675b5f51fd744d17dc.png) In apache we use a bundle that contains the ICPEDU Intermediary + GlobalSIgn Intermediary + GlobalSign Root and works like a charm. In the traefik I made the concatenation including our certificate \*.company.org, staying like this: \*.company.org + ICPEDU intermediary + GlobalSIgn Intermediario + GlobalSign Root This way it did not work and there is always an error informing that no certificate was found. What is the correct order? ---
**Author:** ![cakiwi](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/cakiwi/32/3205_2.png) [@cakiwi](https://community.traefik.io/u/cakiwi)\ **Post date:** [January 26, 2021, 5:49pm UTC](https://community.traefik.io/t/correct-order-from-combine-certificates/9460/2 "2021-01-26T17:49:29Z")
It should be: Leaf certificate + Intermediates.... The root CA should no be present. ---
**Author:** ![empereira](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/empereira/32/3266_2.png) [@empereira](https://community.traefik.io/u/empereira)\ **Post date:** [January 26, 2021, 7:06pm UTC](https://community.traefik.io/t/correct-order-from-combine-certificates/9460/3 "2021-01-26T19:06:44Z")
Should \*.company.org be at the beginning of the file? ---
**Author:** ![cakiwi](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/cakiwi/32/3205_2.png) [@cakiwi](https://community.traefik.io/u/cakiwi)\ **Post date:** [January 26, 2021, 7:14pm UTC](https://community.traefik.io/t/correct-order-from-combine-certificates/9460/4 "2021-01-26T19:14:39Z")
Yes. That would be considered the leaf. ---
**Author:** ![empereira](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/empereira/32/3266_2.png) [@empereira](https://community.traefik.io/u/empereira)\ **Post date:** [January 26, 2021, 7:36pm UTC](https://community.traefik.io/t/correct-order-from-combine-certificates/9460/5 "2021-01-26T19:36:42Z")
Thanks for the help @cakiwi!!! After some tests, I believe that the correct order of the certificates was as follows: -----BEGIN CERTIFICATE----- \*.company.org -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- GlobalSign RSA OV SSL CA 2018 -----END CERTIFICATE----- ---
**Author:** ![cakiwi](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/cakiwi/32/3205_2.png) [@cakiwi](https://community.traefik.io/u/cakiwi)\ **Post date:** [January 26, 2021, 7:39pm UTC](https://community.traefik.io/t/correct-order-from-combine-certificates/9460/6 "2021-01-26T19:39:55Z")
Yes, of course! That matches the output from ssllabs. ---
**Author:** ![system](https://us1.discourse-cdn.com/flex020/uploads/containo/original/2X/b/bd81ebdb578656e76e56ff3cc3eed021d3ba132d.png) [@system](https://community.traefik.io/u/system)\ **Post date:** [January 29, 2021, 7:39pm UTC](https://community.traefik.io/t/correct-order-from-combine-certificates/9460/7 "2021-01-29T19:39:59Z")
This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.