Synapse: Tell people to give synapse the full certificate chain, not just the single certificate

[babolivier]

When using certbot to generate certificates, it generates the following files:

root@errol:~# ls /etc/letsencrypt/live/chat.abolivier.bzh/
cert.pem  chain.pem  fullchain.pem  privkey.pem  README
root@errol:~# 

Since the Synapse docs don't say anything about which one to use, and the relevant config option is named tls_certificate_path, people might tell Synapse to use cert.pem whereas it should be using fullchain.pem, which contains the complete certificate chain. This will likely prevent these people from federating once we start enforcing valid certs.

[richvdh]

we don't really document how to use certbot at all, and I'm not sure it should be our job to do so?

[babolivier]

Yes, my issue was very specific to certbot (thought it would be useful for context), but a simple note of "use the full chain, not just the cert" would be helpful

[anoadragon453]

I believe this has been solved now.