AWS Certificate Manager - certificate verify failed via ELB

I have added Certificate (.crt), Key (.key) & Certificate Chain ( star_domain_net.crt + DigiCertCA.crt + DigiCert Global Root G2.pem ) to AWS ACM & then attached to ELB.

DigiCertCA.crt :

DigiCert Global Root G2.pem :

In Private network clients uses following local Certificate File to validate the HTTPS endpoint. This certificate already distributed to All Clients.

DigiCertGlobalRootCA.crt :

But when client try to authenticate using ssl library, it fails with following error.

23-09-21 09:43:33 ERROR <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:727)>: downloading https://util.domain.net/90d11ae0-108e-4103-ae38-8c2fcb617f47.txt

I confirmed Server is providing the correct Certificate, by

$ openssl s_client -connect util.domain.net:443

CONNECTED(00000003)
depth=0 C = US, ST = New York, L = New York, O = My Org Inc, CN = *.domain.net
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 C = US, ST = New York, L = New York, O = My Org Inc, CN = *.domain.net
verify error:num=21:unable to verify the first certificate
verify return:1
---
Certificate chain
 0 s:/C=US/ST=New York/L=New York/O=My Org Inc/CN=*.domain.net
   i:/C=US/O=DigiCert Inc/CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1
 1 s:/C=US/ST=New York/L=New York/O=My Org Inc/CN=*.domain.net
   i:/C=US/O=DigiCert Inc/CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIG4TCCBcmgAwIBAgIQDh4lM1Oqja0xLpEPn2iwkjANBgkqhkiG9w0BAQsFADBZ
.................
QYlMdVoyhglI+QR9BuwiZbJgOOHC1cf2fdODKocC+zu9IA9N3g==
-----END CERTIFICATE-----
subject=/C=US/ST=New York/L=New York/O=My Org Inc/CN=*.domain.net
issuer=/C=US/O=DigiCert Inc/CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1
---
No client certificate CA names sent
Peer signing digest: SHA512
Server Temp Key: ECDH, P-256, 256 bits
---
SSL handshake has read 4040 bytes and written 431 bytes
---
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES128-GCM-SHA256
Server public key is 2048 bit
Secure Renegotiation IS supported
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-AES128-GCM-SHA256
    Session-ID: 7579F041C93B46972EA3*0B77F250A3667803010
    Session-ID-ctx:
    Master-Key: 33062D70740974563DB7577*C006D1EEE1AB0B0973FD6FB1595
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1696010288
    Timeout   : 300 (sec)
    Verify return code: 21 (unable to verify the first certificate)
---



HTTP/1.1 400 BAD_REQUEST
Content-Length: 0
Connection: Close

closed

When I try to add star_domain_net.crt + DigiCertCA.crt to ACM as certificate Body, I get certificate body provided is not in a valid PEM format error in AWS ACM.

I think its the Certificate Chain causing this failure. What I am missing here ?

Solution

I think the correct order of the certificate chain should be like below,so concatenate the contents of these files in the correct order and then try adding the certificate to AWS ACM again!!!

(1) DigiCert Global Root G2.pem 
(2) DigiCertCA.crt
(3) star_domain_net.crt