preferred chain

[wazwa001]

I am trying to figure out all the types of preferred chains for acme.sh
Can you help me figure it out as I searched online for different examples and could not find it.

I am trying to figure out how to set it for SHA-2 and the following
Certificate Chain:
AAA Certificate Services (root) [[PEM]
USERTrust RSA Certification Authority [[PEM]
InCommon RSA IGTF Server CA 3 [[PEM]
End-Entity Certificate

What would I set the parameter --preferred-chain to?

[neilpang]

--preferred-chain takes the Subject Common Name of an issuer in the chain you want. acme.sh compares it against every chain the CA offers (the default one plus any Link: rel="alternate" alternates) and keeps the first whose issuer chain matches -- see the Preferred-Chain wiki.

Two things to keep in mind:

• It can only pick among chains your CA actually returns as alternates -- you can't construct a chain the CA doesn't offer.
• Match on a CN that appears only in the chain you want. For your example, use the distinguishing root/intermediate, e.g. --preferred-chain "AAA Certificate Services" or --preferred-chain "USERTrust RSA Certification Authority".

For Let's Encrypt the common one is --preferred-chain "ISRG Root X1". If your CA returns only a single chain, the option has no effect.