From what I can determine, you generate a LetsEncrypt certificate that includes the full cert chain thus:
# run lets-enc the usual way # then ..: wget -O intermediate.pem https://letsencrypt.org/certs/lets-encrypt-x1-cross-signed.pem cat DOMAIN.crt intermediate.pem >DOMAIN.pem # now use DOMAIN.pem instead of DOMAIN.crt
Unfortunately, when I do that, Exim4 resp. GnuTLS complains that
(cert/key setup: cert=/etc/letsencrypt/keys/DOMAIN.pem key=/etc/letsencrypt/keys/DOMAIN.key): The provided X.509 certificate list is not sorted (in subject to issuer order)
and refuses to enable SSL.
Since using the "naked" .CRT file results in annoying certificate warnings on some clients (it works, otherwise), I'd like to fix that.