Getting "Could not validate the certificate with the certificate chain" when trying to use the newly generated certificate

[marius-locomotion]

Welcome

• Yes, I'm using a binary release within 2 latest releases.
• Yes, I've searched similar issues on GitHub and didn't find any.
• Yes, I've included all information below (version, config, etc).

What did you expect to see?

I generated Let'sEncrypt certificate using lego and I tried uploading it to AWS certificate manager.
Before trying to upload, I removed the 2 intermediate certs from the main cert file, keeping just the domain certificate.
I expected for the upload to work correctly

What did you see instead?

However, I get this error:

"An error occurred (ValidationException) when calling the ImportCertificate operation: Could not validate the certificate with the certificate chain."

How do you use lego?

Binary

Reproduction steps

1. Generate the certificate using the command:

CLOUDNS_AUTH_ID=XXX CLOUDNS_AUTH_PASSWORD=YYY ./lego --email [email protected] --dns cloudns --domains mydomain.org --domains *.mydomain.org -accept-tos run

2. Removed the 2 extra issuer's certificates from the file .lego/certificates/mydomain.org.crt
3. Ran this command to upload the cert and key to the AWS certificate manager:

aws acm import-certificate --certificate fileb://.lego/certificates/mydomain.org.crt --certificate-chain fileb://.lego/certificates/mydomain.org.issuer.crt --private-key fileb://.lego/certificates/mydomain.org.key

I have the same issue when I use AWS as DNS provider, with another domain.
So I think there is something I must be doing wrong here.
Can you please help?

Version of lego

lego version 4.5.3 linux/amd64

Logs

An error occurred (ValidationException) when calling the ImportCertificate operation: Could not validate the certificate with the certificate chain.

Go environment (if applicable)

GO111MODULE=""
GOARCH="amd64"
GOBIN=""
GOCACHE="/root/.cache/go-build"
GOENV="/root/.config/go/env"
GOEXE=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOINSECURE=""
GONOPROXY=""
GONOSUMDB=""
GOOS="linux"
GOPATH="/root/go"
GOPRIVATE=""
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/usr/local/go"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/usr/local/go/pkg/tool/linux_amd64"
GCCGO="gccgo"
AR="ar"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
GOMOD=""
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build746721441=/tmp/go-build -gno-record-gcc-switches"

[marius-locomotion]

I am getting the same error when I try uploading the cert manually, from AWS portal.

[marius-locomotion]

I think something may be wrong with the key, it seems very short.
When I generated certificates using a terraform acme provider for letsencrypt, I usually got a bigger key, similar in size (number of lines) to the certificate itself..

-----BEGIN EC PRIVATE KEY-----
MHcCAQEEIK0dHECTufcUbv8s68seK7tWbtBKAqQs7KOYwf5rsPCVoAoGCCqGSM49
AwEHoUQDQgAE4beaIuYqesJegDt3HhdpIzuXwbRD44XLj7RM9ZSD8B9TdyFVNGaZ
os0Qhk9HJFdhKzJnUdtUReGz/FmaXkkw/g==
-----END EC PRIVATE KEY-----