6

I recently renewed the SSL certificate on my site and while initially it seemed that the certificated was installed correctly, I was shocked to discover hours ago that the HTTPS connection no longer authenticates correctly with certain browsers and versions.

It currently authenticates OK with the following browsers:

  • Internet Explorer 8
  • Internet Explorer 9
  • Google Chrome 8
  • Opera 11
  • Firefox 3.6.21 (on Windows 2000)

But it does NOT authenticate properly with:

  • Firefox 3.6.13 (on Windows XP)
  • Firefox 6.01 (on Windows 7)
  • Internet Explorer 6 (on Windows 200)

The certificate has the certificate path of GeoTrust Global CA > RapidSSL CA > secure.mydomain.com.

What could possibly explain this problem? Is this an installation problem? Browser problem? Certificate problem?

How do I solve this problem?

5
  • My initial reaction would be either an intermediate or root certificate in the chain isn't trusted by the affected browsers, but the Firefox 6.0.1 is throwing me. Is that confirmed by multiple users, or just one that may have been messing with trusted certificates in Firefox? Sep 4, 2011 at 15:47
  • Are all of the browsers using the newest version of SSL? (3.0 I think)?
    – U4iK_HaZe
    Sep 4, 2011 at 16:04
  • @Ben Pilbrow Many thanks (+1) for your comment. Right now I am the only one testing this (on different machines and browsers) and I can tell you that the Firefox 6.0.1 is running on a brand new Windows 7 netbook that didn't have a chance to be messed with.
    – scatmoi
    Sep 4, 2011 at 16:07
  • Are you in a position to share the domain name this is happening with? It's OK if you don't want to, it just might make troubleshooting easier. Sep 4, 2011 at 16:12
  • @Ben Pilbrow I am the one who purchased the certificate but I am not the one who installed it. Installation was performed by my webhost's support as it is on a shared web hosting account. My experience with these folks is that they sometimes need guidance, especially in difficult to troubleshoot situations like this one. I am trying to gather as much information as possible, so that it can be helpful not only for me, but also for future techs encountering this. So I would like to keep this as general as possible.
    – scatmoi
    Sep 4, 2011 at 16:22

4 Answers 4

7

I had the same problem - bought a basic SSL certificate (from Network Solutions), installed it under nginx, and it worked fine in both Opera and IE - but not Firefox 3.6.12. This is how I solved the problem. Note that I have root/shell access to my VPS, I don't know if you do (at least this might point your providers in the right direction).

The first step in finding the solution was using Qualys (as per this other answer). It told me that the chain was incomplete.

Second, I used OpenSSL for testing/debugging. Assuming you have shell access, you can do the command (q or CTRL-C to disconnect):

openssl s_client -connect mysite.com:443

and you will probably see the error "unable to get local issuer certificate". This is also a way to test when it's working, in the shell, without running Firefox.

SSL Certificate Chains

Some browsers may complain about a certificate signed by a well-known certificate authority, while other browsers may accept the certificate without issues. This occurs because the issuing authority has signed the server certificate using an intermediate certificate that is not present in the certificate base of well-known trusted certificate authorities which is distributed with a particular browser. In this case the authority provides a bundle of chained certificates which should be concatenated to the signed server certificate. The server certificate must appear before the chained certificates in the combined file

Nginx configuration

In my case, I had gotten three files from Network Solutions - mysite.com.crt, AddTrustExternalCARoot.crt, and NetworkSolutionsDVServerCA.crt. There was no bundle file, but it's possible to create one from the other certificates. After some trial-and-error, I found what I needed was:

$ cat mysite.com.crt NetworkSolutionsDVServerCA.crt > mysite.com.chain.crt

The final step was to reconfigure my nginx server with the new file:

server {
    listen       443;
    ssl          on;
    ssl_certificate        /etc/ssl/certs/mysite.com.chain.crt;
    ssl_certificate_key    /etc/ssl/private/mysite.com.key;

    server_name  mysite.com;
    # and so on
}

After getting the right certificates in the bundle, and restarting nginx, openssl reported no errors, Firefox got the page with no problem, and Qualys reported the chain was valid.

Apache configuration

Since you're running Apache, then you (or your providers) need to configure it for SSL with the correct file locations, one of which is the missing intermediate chain file:

<VirtualHost 192.168.0.1:443>
    DocumentRoot /var/www/html2
    ServerName www.yourdomain.com
    SSLEngine on
    SSLCertificateFile /path/to/your_domain_name.crt
    SSLCertificateKeyFile /path/to/your_private.key
    SSLCertificateChainFile /path/to/DigiCertCA.crt
</VirtualHost>
1
  • The chainfile is easy to forget, make sure you include it guys. thanks for the answer cyclops
    – andrewk
    Dec 22, 2012 at 2:09
5

Try the following tests on your domain:

Qualys: https://www.ssllabs.com/ssldb/index.html

DigiCert: http://www.digicert.com/help/

I've found both very handy for pinning down random SSL certificate issues.

1
  • 1
    That first site (Qualys) is very useful. I'm having the same problem with Firefox, and previously tried DigiCert, who said my cert was fine. But Qualys says the chain is incomplete, so maybe something is missing after all.
    – Cyclops
    Oct 24, 2011 at 14:02
1

I use this for Nginx and StartSSL, it needs the class CA too:

cat ssl.pem ca.pem sub.class1.server.ca.pem > server.pem

or

cat ssl.pem ca.pem sub.class2.server.ca.pem > server.pem

(according to your class level)

1
  • Regardless, the certificate likely expired by now ;-) Jun 20, 2014 at 12:51
1

A certificate can contain a special Authority Information Access extension (RFC-3280) with URL to issuer's certificate. Most browsers can use the AIA extension to download missing intermediate certificate to complete the certificate chain. But some clients (older and mobile browsers, OpenSSL) don't support this extension, so they report such certificate as untrusted.

You can solve the incomplete certificate chain issue manually by concatenating all certificates from the certificate to the trusted root certificate (exclusive, in this order), to prevent such issues. Note, the trusted root certificate should not be there, as it is already included in the system’s root certificate store.

You should be able to fetch intermediate certificates from the issuer and concat them together by yourself. I have written a script to automate the procedure, it loops over the AIA extension to produce output of correctly chained certificates. https://github.com/zakjan/cert-chain-resolver

2
  • Please stop promoting your script in more than one question. One is enough. Jan 19, 2015 at 10:56
  • I believe my answer is totally relevant and helpful to the question.
    – zakjan
    Jan 19, 2015 at 12:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .