Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm having some weird ssl issues with nginx and my cert from Most browsers work with it, but some aren't able to verify the cert. I want to verify that I set things up properly.

When I got a wildcard ssl cert from they sent me these files:


I also have my private key file that i generated. I configured nginx like so:

ssl_certificate /etc/ssl/ca-bundle.crt;
ssl_certificate_key /etc/ssl/mydomain.key;

/etc/ssl/ca-bundle.crt is just all the files gave me concatenated together.

Does this sound right?


share|improve this question

2 Answers 2

up vote 0 down vote accepted

As for your concatenation, RFC 5246 states:

The sender’s certificate must come first in the list. Each following certificate must directly certify the one preceding it. Because certificate validation requires that root keys be distributed independently, the self-signed certificate that specifies the root certificate authority may optionally be omitted from the chain, under the assumption that the remote end must already possess it in order to validate it in any case.

So what you need to do is order the cert-bundle in the proper way: The server cert on top, down to the certificate that is closest to the root certificate. Most SSL implementations seem to fix an incorrect order, either on the client or server side, but I have already run into a borderline case, and maybe so have you.

I don't know if links like this are acceptable here, but I have outlined the procedure (even for a similar chain as you have) in an older blog entry: Dealing with lengthy SSL certificate chains

share|improve this answer
thanks a ton!!!! – rizen Nov 13 '10 at 17:22

The order to concatenate these files is:

  1. yoursite.crt
  2. USERTrustRSADomainValidationSecureServerCA.crt
  3. USERTrustRSACertificationAuthority.crt
  4. AddTrustExternalCARoot.crt
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.