1

I'm having some weird ssl issues with nginx and my cert from register.com. Most browsers work with it, but some aren't able to verify the cert. I want to verify that I set things up properly.

When I got a wildcard ssl cert from register.com they sent me these files:

AddTrushExternalCARoot.crt
RegistercomSSLServiceCAOV.crt
STAR_mydomain_net.crt
UTNAddTrushServer_CA.crt

I also have my private key file that i generated. I configured nginx like so:

ssl_certificate /etc/ssl/ca-bundle.crt;
ssl_certificate_key /etc/ssl/mydomain.key;

/etc/ssl/ca-bundle.crt is just all the files register.com gave me concatenated together.

Does this sound right?

Thanks

2 Answers 2

1

As for your concatenation, RFC 5246 states:

The sender’s certificate must come first in the list. Each following certificate must directly certify the one preceding it. Because certificate validation requires that root keys be distributed independently, the self-signed certificate that specifies the root certificate authority may optionally be omitted from the chain, under the assumption that the remote end must already possess it in order to validate it in any case.

So what you need to do is order the cert-bundle in the proper way: The server cert on top, down to the certificate that is closest to the root certificate. Most SSL implementations seem to fix an incorrect order, either on the client or server side, but I have already run into a borderline case, and maybe so have you.

I don't know if links like this are acceptable here, but I have outlined the procedure (even for a similar chain as you have) in an older blog entry: Dealing with lengthy SSL certificate chains

0
2

The order to concatenate these files is:

  1. yoursite.crt
  2. USERTrustRSADomainValidationSecureServerCA.crt
  3. USERTrustRSACertificationAuthority.crt
  4. AddTrustExternalCARoot.crt

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .