Cloudron's functionality works just as intended. The problem is in docs in major sites and hence chatGPT as well (which I used to troubleshoot that).

All of the docs, except for NameCheap (thanks, guys!) says that the correct way to combine crt files - is just do cat .. > final.crt which lead to one problem:

-----END CERTIFICATE----------BEGIN CERTIFICATE-----

On the line 37, which, absolutely reasonably, brakes any SSL parser.

Correct way to join CRT files is:

cat STAR.*.crt > ssl-complete-bundle.crt && echo >> ssl-complete-bundle.crt && cat STAR.*.ca-bundle >> ssl-complete-bundle.crt

And you can check if it is valid than with

openssl x509 -noout -in ssl-complete-bundle.crt -checkhost test.`basename STAR.*.crt | sed -E 's/^STAR\.([^.]+(\.[^.]+)?)\.crt$/\1/'`

Guess, it might make sense to document it.

openssl x509 -noout -in STAR.domain.com.crt -checkhost test.domain.com works on pure (aka 'leaf') CRT file, but fails on a bundle (cat STAR.*.crt STAR.*.ca-bundle > ssl-complete-bundle.crt) - with an intermediate certificate build-in.

And if I upload that pure / leaf certificate, then all apps that are not browsers fails with unable to verify the first certificate kind of error (that particular is from UpTime Kuma) - as an intermediate certificate is missing.

So, I would say that own wildcard certificate functionality is quite broken as of now on Cloudron.

do I ssh into cloudron to issue that command? If yes, what is the location of the cert_file? I searched through cloudron dashboard does not have terminal access, and I 'find -type f -iname *.crt' but don't see the certificate uploaded.

Yes, the purchased certificate is a *.domain.com and I am uploading it to here.