### How Do I Know if My Certificates are in PEM Format?

You can recognize the PEM format by the following traits:

- The file begins with the following header:
  `-----BEGIN CERTIFICATE-----`
- The header is followed by a long string of characters. Like, really long.
- The file ends with a footer:
  `-----END CERTIFICATE-----`

PEM Certificate Example:

    ----BEGIN CERTIFICATE-----
    MIIGVDCCBDygAwIBAgIJAMiIrEm29kRLMA0GCSqGSIb3DQEBCwUAMHkxCzAJBgNV
    ... more lines
    VWQqljhfacYPgp8KJUJENQ9h5hZ2nSCrI+W00Jcw4QcEdCI8HL5wmg==
    -----END CERTIFICATE-----

### How Can I Encode My PEM Files in base64?

To encode your certificates in base64:

1. Change directory to where the PEM file resides.
2. Run one of the following commands. Replace `FILENAME` with the name of your certificate.

       # MacOS
       cat FILENAME | base64
       # Linux
       cat FILENAME | base64 -w0
       # Windows
       certutil -encode FILENAME FILENAME.base64

### How Can I Verify My Generated base64 String For The Certificates?

To decode your certificates in base64:

1. Copy the generated base64 string.
2. Run one of the following commands. Replace `YOUR_BASE64_STRING` with the previously copied base64 string.

       # MacOS
       echo YOUR_BASE64_STRING | base64 -D
       # Linux
       echo YOUR_BASE64_STRING | base64 -d
       # Windows
       certutil -decode FILENAME.base64 FILENAME.verify

### What is the Order of Certificates if I Want to Add My Intermediate(s)?

The order of adding certificates is as follows:

    -----BEGIN CERTIFICATE-----
    %YOUR_CERTIFICATE%
    -----END CERTIFICATE-----
    -----BEGIN CERTIFICATE-----
    %YOUR_INTERMEDIATE_CERTIFICATE%
    -----END CERTIFICATE-----

### How Do I Validate My Certificate Chain?

You can validate the certificate chain by using the `openssl` binary. If the output of the command (see the command example below) ends with `Verify return code: 0 (ok)`, your certificate chain is valid. The `ca.pem` file must be the same as you added to the `rancher/rancher` container. When using a certificate signed by a recognized Certificate Authority, you can omit the `-CAfile` parameter.

##### Command:

    openssl s_client -CAfile ca.pem -connect rancher.yourdomain.com:443 -servername rancher.yourdomain.com
    ...
        Verify return code: 0 (ok)