you will need the LE root + intermediary in the pem file, and you can leave the leaf certificate off