Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm having some weird ssl issues with nginx and my cert from register.com. Most browsers work with it, but some aren't able to verify the cert. I want to verify that I set things up properly.

When I got a wildcard ssl cert from register.com they sent me these files:

AddTrushExternalCARoot.crt
RegistercomSSLServiceCAOV.crt
STAR_mydomain_net.crt
UTNAddTrushServer_CA.crt

I also have my private key file that i generated. I configured nginx like so:

ssl_certificate /etc/ssl/ca-bundle.crt;
ssl_certificate_key /etc/ssl/mydomain.key;

/etc/ssl/ca-bundle.crt is just all the files register.com gave me concatenated together.

Does this sound right?

Thanks

share|improve this question
add comment

1 Answer

up vote 0 down vote accepted

As for your concatenation, RFC 5246 states:

The sender’s certificate must come first in the list. Each following certificate must directly certify the one preceding it. Because certificate validation requires that root keys be distributed independently, the self-signed certificate that specifies the root certificate authority may optionally be omitted from the chain, under the assumption that the remote end must already possess it in order to validate it in any case.

So what you need to do is order the cert-bundle in the proper way: The server cert on top, down to the certificate that is closest to the root certificate. Most SSL implementations seem to fix an incorrect order, either on the client or server side, but I have already run into a borderline case, and maybe so have you.

I don't know if links like this are acceptable here, but I have outlined the procedure (even for a similar chain as you have) in an older blog entry: Dealing with lengthy SSL certificate chains

share|improve this answer
    
thanks a ton!!!! –  rizen Nov 13 '10 at 17:22
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.