openssl: No certificate matches private key / chained certificate

Question

I am getting this error while binding a chained certificate with a private key:

"No certificate matches private key"

the command I use is the following:

openssl pkcs12 -export -in chainedcertificate.pem -inkey private.pem -name MyCert -out chained.p12

Inside my chainedcertificate.pem is three blocks of BEGIN/END CERTIFICATE. CA, Intermediate and user certificate are in the file in reverse order (i.e. CA being last).

When I remove the the two last blocks and leave only the user certifcate, the chained.p12 is generated without any error.

Why would the insertion of the root certificate and intermediate would compromise the creation with this kind of error message ???

Solution

I just had such a problem and it turned out that the "chainedcertificate.pem" file must have root, intermediate, key certificate in this exact order. Then it worked.