Iʼm trying to create my own certificate authority using the XCA software. I have successfully created the root CA (Fisir Technologies CA
) and intermediate CA (Fisir Technologies Intermediate CA X1
). However, I want to have one more intermediate CA (Fisir Technologies Endpoint CA WWW
) under the first intermediate CA (Fisir Technologies Intermediate CA X1
). The second intermediate CA is supposed to issue the end entity certificates.
Iʼve done all this and imported my root CA as a trusted root certificate authority (on Windows). Then, I created a new HTTPS certificate signed by the second intermediate CA. I tried to open it with the default certificate viewer on Windows, but it told me that it doesnʼt have enough information to validate the certificate. That was what I expected, as I had installed only the root CA.
So I created a certificate chain, including the root CA, the two intermediate CAs and the HTTPS certificate. I uploaded it onto my VPS, set up the HTTPS server in nginx and tried accessing it. But Google Chrome welcomed me with a NET::ERR_CERT_INVALID
error.
I clicked on the crossed red lock in the address bar and it said that the certificate is not valid. So I chose to view the certificate and it opened it again in the Windows default certificate viewer. But it did not show any error. I looked at the certificate path and it was shown correctly:
It also said that the certificate is valid. Also, every online HTTPS checker that I could found did not show any issue with the setup (except for untrusted root CA, of course).
I tried to modify various properties of the certificate, but it would never work. Then I tried to issue the exact same certificate as the first time, but this time I signed it with the first intermediate CA. I refreshed the page and it worked.
But I want to issue the certificates using the second intermediate CA. Anyone knows what the problem might be?
You can check the problem for yourself live at https://php.technologies.fisir.net.
Thank you.