Some systems are still running in Ubuntu 16.04 that cannot be upgraded easily but they will be fully replaced by Ubuntu 22.04 machines later this year; unfortunately, to get LetsEncrypt to work on those machines, you need to remove the unknown trusted authority that is added to the end of each fullchain.pem for each live LetsEncrypt certificate.

Right now, I'm doing this manually, but I'm looking for an elegant way of doing this programmatically since the server we are going to change has quite a lot certificates on there, so to recap:

Is there an elegant way (using openssl or another tool, not just sed) to get rid of the third certificate that exists in my fullchain.pem's?


1 Answer 1


openssl can do what you want:

$ ( openssl x509; openssl x509 ) < fullchain.pem > first_two.pem

Now the file first_two.pem contains the first two certificates from fullchain.pem.

Beware that the old DST Root CA X3 will grow back the next time the cert renews. Unless you have other obsolete systems that require the now-expired Root CA X3, you might want to consider changing your LetsEncrypt renewal script to eliminate the expired X3 cert altogether. If you use the --preferred-chain "ISRG Root X1" option in your certbot command line syntax, the cert you receive will not reference the old Root CA X3 at all. Do that and you won't need to do the above.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .