4

I am having a strange problem. I have installed a new certificate from RapidSSL onto Apache on an Ubuntu server for the website http://www.radflek.com/shop/.

It seems to work absolutely fine on all PC browsers I try, but when I try on iPhone or iPad I receive the error: "Safari cannot open the page because it could not establish a secure connection to the server.".

Can anyone advise as to what might be wrong?!

UPDATE: I was unable to solve this issue, but when iOS 5.1 was released this issue resolved itself entirely so it appears to be related to iOS5.0 only.

4
  • It's been reported that some GeoTrust CAs are not in Safari's keychain. This may be the case for you; does Safari report that the certificate is not trusted because it is not issued by a trusted authority or because it can not be verified?
    – Chris S
    Feb 4, 2012 at 19:18
  • That is the whole error message... not much to go on
    – faroligo
    Feb 4, 2012 at 19:21
  • Have you tried Safari browser for Windows? If it will have the same behaviour as on iPhone, then @ChrisS is correct.
    – LazyOne
    Feb 4, 2012 at 19:36
  • Haven't tried Safari for Windows but on Safari for OSX it works fine
    – faroligo
    Feb 5, 2012 at 2:15

3 Answers 3

5

They gave you an incomplete certificate chain; mobile browsers tend to be a little more sensitive to chain issues than others. The intermediate issuer certificate with a thumbprint of c039a3269ee4b8e82d00c53fa797b5a19e836f47 is being presented correctly, but the "root" certificate that your server is presenting isn't a root certificate at all; it's an intermediate.

The real root cert (de28f4a4ffe5b92fa3c503d1a349a7f9962a8212, which most browsers will figure out), and the presented root-that-isn't (7359755c6df9a0abc3060bce369564c8ec4542a3) share the same cryptographic key, so their signing relationship with the issuing CA works either way - but the presented root's not a root at all, its trust chain relies on a root certificate (d23209ad23d314232174e40d7f9d62139786633a) that isn't being sent.


Either they gave you a certificate bundle to point to with an SSLCertificateChainFile directive, or rolled the roots into the public key file that's pointed at with SSLCertificateFile - figure out which, then you'll be modifying that file.

Copy the file as a backup before modifying it. Then, find this section:

-----BEGIN CERTIFICATE-----
MIIDfTCCAuagAwIBAgIDErvmMA0GCSqGSIb3DQEBBQUAME4xCzAJBgNVBAYTAlVT
MRAwDgYDVQQKEwdFcXVpZmF4MS0wKwYDVQQLEyRFcXVpZmF4IFNlY3VyZSBDZXJ0
aWZpY2F0ZSBBdXRob3JpdHkwHhcNMDIwNTIxMDQwMDAwWhcNMTgwODIxMDQwMDAw
WjBCMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNR2VvVHJ1c3QgSW5jLjEbMBkGA1UE
AxMSR2VvVHJ1c3QgR2xvYmFsIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
CgKCAQEA2swYYzD99BcjGlZ+W988bDjkcbd4kdS8odhM+KhDtgPpTSEHCIjaWC9m
OSm9BXiLnTjoBbdqfnGk5sRgprDvgOSJKA+eJdbtg/OtppHHmMlCGDUUna2YRpIu
T8rxh0PBFpVXLVDviS2Aelet8u5fa9IAjbkU+BQVNdnARqN7csiRv8lVK83Qlz6c
JmTM386DGXHKTubU1XupGc1V3sjs0l44U+VcT4wt/lAjNvxm5suOpDkZALeVAjmR
Cw7+OC7RHQWa9k0+bw8HHa8sHo9gOeL6NlMTOdReJivbPagUvTLrGAMoUgRx5asz
PeE4uwc2hGKceeoWMPRfwCvocWvk+QIDAQABo4HwMIHtMB8GA1UdIwQYMBaAFEjm
aPkr0rKV10fYIyAQTzOYkJ/UMB0GA1UdDgQWBBTAephojYn7qwVkDBF9qn1luMrM
TjAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjA6BgNVHR8EMzAxMC+g
LaArhilodHRwOi8vY3JsLmdlb3RydXN0LmNvbS9jcmxzL3NlY3VyZWNhLmNybDBO
BgNVHSAERzBFMEMGBFUdIAAwOzA5BggrBgEFBQcCARYtaHR0cHM6Ly93d3cuZ2Vv
dHJ1c3QuY29tL3Jlc291cmNlcy9yZXBvc2l0b3J5MA0GCSqGSIb3DQEBBQUAA4GB
AHbhEm5OSxYShjAGsoEIz/AIx8dxfmbuwu3UOx//8PDITtZDOLC5MH0Y0FWDomrL
NhGc6Ehmo21/uBPUR/6LWlxz/K7ZGzIZOKuXNBSqltLroxwUCEm2u+WR74M26x1W
b8ravHNjkOR/ez4iyz0H7V84dJzjA1BOoa+Y7mHyhD8S
-----END CERTIFICATE-----

And replace it with this, to present the version of the root that's actually a root certificate:

-----BEGIN CERTIFICATE-----
MIIDVDCCAjygAwIBAgIDAjRWMA0GCSqGSIb3DQEBBQUAMEIxCzAJBgNVBAYTAlVT
MRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMRswGQYDVQQDExJHZW9UcnVzdCBHbG9i
YWwgQ0EwHhcNMDIwNTIxMDQwMDAwWhcNMjIwNTIxMDQwMDAwWjBCMQswCQYDVQQG
EwJVUzEWMBQGA1UEChMNR2VvVHJ1c3QgSW5jLjEbMBkGA1UEAxMSR2VvVHJ1c3Qg
R2xvYmFsIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA2swYYzD9
9BcjGlZ+W988bDjkcbd4kdS8odhM+KhDtgPpTSEHCIjaWC9mOSm9BXiLnTjoBbdq
fnGk5sRgprDvgOSJKA+eJdbtg/OtppHHmMlCGDUUna2YRpIuT8rxh0PBFpVXLVDv
iS2Aelet8u5fa9IAjbkU+BQVNdnARqN7csiRv8lVK83Qlz6cJmTM386DGXHKTubU
1XupGc1V3sjs0l44U+VcT4wt/lAjNvxm5suOpDkZALeVAjmRCw7+OC7RHQWa9k0+
bw8HHa8sHo9gOeL6NlMTOdReJivbPagUvTLrGAMoUgRx5aszPeE4uwc2hGKceeoW
MPRfwCvocWvk+QIDAQABo1MwUTAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBTA
ephojYn7qwVkDBF9qn1luMrMTjAfBgNVHSMEGDAWgBTAephojYn7qwVkDBF9qn1l
uMrMTjANBgkqhkiG9w0BAQUFAAOCAQEANeMpauUvXVSOKVCUn5kaFOSPeCpilKIn
Z57QzxpeR+nBsqTP3UEaBU6bS+5Kb1VSsyShNwrrZHYqLizz/Tt1kL/6cdjHPTfS
tQWVYrmm3ok9Nns4d0iXrKYgjy6myQzCsplFAMfOEVEiIuCl6rYVSAlk6l5PdPcF
PseKUgzbFbS9bZvlxrFUaKnjaZC2mqUPuLk/IH2uSrW4nOQdtqvmlKXBx4Ot2/Un
hw4EbNX/3aBd7YdStysVAq45pmp06drE57xNNB6pXE0zX5IJL4hmXXeXxx12E6nV
5fEWCRE11azbJHFwLJhWC9kXtNHjUStedejV0NxPNO3CBWaAocvmMw==
-----END CERTIFICATE-----

Or, as option B if that causes issues for some reason, you could instead leave the current "root" in place then add its root certificate to the chain, at the bottom of the file:

-----BEGIN CERTIFICATE-----
MIIDIDCCAomgAwIBAgIENd70zzANBgkqhkiG9w0BAQUFADBOMQswCQYDVQQGEwJV
UzEQMA4GA1UEChMHRXF1aWZheDEtMCsGA1UECxMkRXF1aWZheCBTZWN1cmUgQ2Vy
dGlmaWNhdGUgQXV0aG9yaXR5MB4XDTk4MDgyMjE2NDE1MVoXDTE4MDgyMjE2NDE1
MVowTjELMAkGA1UEBhMCVVMxEDAOBgNVBAoTB0VxdWlmYXgxLTArBgNVBAsTJEVx
dWlmYXggU2VjdXJlIENlcnRpZmljYXRlIEF1dGhvcml0eTCBnzANBgkqhkiG9w0B
AQEFAAOBjQAwgYkCgYEAwV2xWGcIYu6gmi0fCG2RFGiYCh7+2gRvE4RiIcPRfM6f
BeC4AfBONOziipUEZKzxa1NfBbPLZ4C/QgKO/t0BCezhABRP/PvwDN1Dulsr4R+A
cJkVV5MW8Q+XarfCaCMczE1ZMKxRHjuvK9buY0V7xdlfUNLjUA86iOe/FP3gx7kC
AwEAAaOCAQkwggEFMHAGA1UdHwRpMGcwZaBjoGGkXzBdMQswCQYDVQQGEwJVUzEQ
MA4GA1UEChMHRXF1aWZheDEtMCsGA1UECxMkRXF1aWZheCBTZWN1cmUgQ2VydGlm
aWNhdGUgQXV0aG9yaXR5MQ0wCwYDVQQDEwRDUkwxMBoGA1UdEAQTMBGBDzIwMTgw
ODIyMTY0MTUxWjALBgNVHQ8EBAMCAQYwHwYDVR0jBBgwFoAUSOZo+SvSspXXR9gj
IBBPM5iQn9QwHQYDVR0OBBYEFEjmaPkr0rKV10fYIyAQTzOYkJ/UMAwGA1UdEwQF
MAMBAf8wGgYJKoZIhvZ9B0EABA0wCxsFVjMuMGMDAgbAMA0GCSqGSIb3DQEBBQUA
A4GBAFjOKer89961zgK5F7WF0bnj4JXMJTENAKaSbn+2kmOeUJXRmm/kEd5jhW6Y
7qj/WsjTVbJmcVfewCHrPSqnI0kBBIZCe/zuf6IWUrVnZ9NA2zsmWLIodz2uFHdh
1voqZiegDfqnc1zqcPGUIWVEX/r87yloqaKHee9570+sB3c4
-----END CERTIFICATE-----

Restart Apache fully after making changes - a graceful restart or "reload" doesn't pick up the changed certificate files correctly.

15
  • Thanks so much for taking the time to have a look. I tried options A and B but the same issue seems to be occurring. I have left you option A in place, do you think you might be able to have another look?
    – faroligo
    Feb 5, 2012 at 2:15
  • @faroligo Looks like I'm seeing option B from the site at the moment - is that intended? Hmm, definitely still broken with that though - and either option ought to work because both CAs are in the list of iOS trusted roots. Something else is amiss - Do you have a manually defined SSLCipherSuite directive? What's in it, if so? Feb 5, 2012 at 4:39
  • you are right, I had left option B in place, have now switched to option A again. You can see the chian file: gist.github.com/5ba269759df9a318deb7 I do not currently have a manually defined SSLCipherSuite, I previously tried with SSLCipherSuite !NULL:!ADH:!EXP:!LOW:SSLv3:+HIGH:+MEDIUM but that didn't seem to make a different. I have included the apache conf for the SSL site here: gist.github.com/d7c60d9a37e21021b758
    – faroligo
    Feb 5, 2012 at 11:21
  • any other ideas?
    – faroligo
    Feb 6, 2012 at 16:16
  • Nothing in that config looks amiss to me.. is there anything else touching port 443 at all? What do you get from apache2ctl -S? And this this a long shot, but I'm guessing there's nothing useful in the error log? Feb 6, 2012 at 16:52
0

Here's a StackOverflow posting related to RapidSSL intermediate certs on mobile devices:

https://stackoverflow.com/questions/7203857/rapidssl-certificate-not-trusted-on-android-tablet

2
  • The bundle that's linked to in the highest voted answer there has the same incomplete-chain issue. Feb 4, 2012 at 21:57
  • Yes, that post describes exactly what I am doing.
    – faroligo
    Feb 5, 2012 at 11:41
0

A certificate can contain a special Authority Information Access extension (RFC-3280) with URL to issuer's certificate. Most browsers can use the AIA extension to download missing intermediate certificate to complete the certificate chain. But some clients (mobile browsers, OpenSSL) don't support this extension, so they report such certificate as untrusted.

You can solve the incomplete certificate chain issue manually by concatenating all certificates from the certificate to the trusted root certificate (exclusive, in this order), to prevent such issues. Note, the trusted root certificate should not be there, as it is already included in the system’s root certificate store.

You should be able to fetch intermediate certificates from the issuer and concat them together by yourself. I have written a script to automate the procedure, it loops over the AIA extension to produce output of correctly chained certificates. https://github.com/zakjan/cert-chain-resolver

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .