0

On http://www.whynopadlock.com/check.php whilst testing the following url https://www.bobclubs.com/pay I get the following message:-

ERROR: cannot verify www.bobclubs.com's certificate, issued by `/C=US/O=GeoTrust, Inc./CN=RapidSSL CA': Unable to locally verify the issuer's authority.

I am not 100 sure why this is as all issuer is OK, all items are secure and I get a padlock on all browsers.

No pad lock message

Can any one shed some light on this?

3 Answers 3

3

most probably you did not install intermediate certificate included in message you've received from rapid ssl. take a look here.

9
  • Since the site works in a browser, that's evidently not the problem.
    – Jenny D
    Jul 4, 2012 at 9:22
  • 2
    not necessarily. i use rapidssl as well and saw validating tools failing and browsers not warning.
    – pQd
    Jul 4, 2012 at 9:33
  • @pQd A good example is mobile devices which don't update their cert storage as Android <2.2 did when Geotrust and RapidSSL changed their root cert.
    – Shadok
    Jul 4, 2012 at 9:50
  • Firefox has the CA certs for both RapidSSL and GeoTrust CA. That means that the chain will work all the way back to GeoTrust even if the server doesn't present the GeoTrust cert. If you remove the RapidSSL cert from the browser's list of CA certs, the browser will give you a warning. You can test this easily with openssl verify, too.
    – Jenny D
    Jul 4, 2012 at 10:02
  • @jenny D - can you please tell then what's the point of intermediate cert? thx!
    – pQd
    Jul 4, 2012 at 21:38
5

Presumably, whatever list of trusted CA certificates that whynopadlock.com uses does not include the CA certificate at the root of the trust chain used by your certificate. Given that you claim that browsers seem to trust the certificate, then I'd say it's a limitation of the testing site.

4

It looks like you did not setup the intermediate certificate correctly.
Most browsers will still show the lock in this situation.

Take a look at this verifier from rapidssl:
https://knowledge.rapidssl.com/support/ssl-certificate-support/index?page=content&id=SO9556

And fix by following this document (Apache):
https://knowledge.rapidssl.com/support/ssl-certificate-support/index?page=content&id=SO6252&actp=LIST&viewlocale=en_US

Or this one (IIS):
https://knowledge.rapidssl.com/support/ssl-certificate-support/index?page=content&id=SO10517&actp=LIST&viewlocale=en_US

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .