Cert must be fullchain for most webservers