Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I recently renewed the SSL certificate on my site and while initially it seemed that the certificated was installed correctly, I was shocked to discover hours ago that the HTTPS connection no longer authenticates correctly with certain browsers and versions.

It currently authenticates OK with the following browsers:

  • Internet Explorer 8
  • Internet Explorer 9
  • Google Chrome 8
  • Opera 11
  • Firefox 3.6.21 (on Windows 2000)

But it does NOT authenticate properly with:

  • Firefox 3.6.13 (on Windows XP)
  • Firefox 6.01 (on Windows 7)
  • Internet Explorer 6 (on Windows 200)

The certificate has the certificate path of GeoTrust Global CA > RapidSSL CA > secure.mydomain.com.

What could possibly explain this problem? Is this an installation problem? Browser problem? Certificate problem?

How do I solve this problem?

share|improve this question
    
My initial reaction would be either an intermediate or root certificate in the chain isn't trusted by the affected browsers, but the Firefox 6.0.1 is throwing me. Is that confirmed by multiple users, or just one that may have been messing with trusted certificates in Firefox? –  Ben Pilbrow Sep 4 '11 at 15:47
    
@Ben Pilbrow Many thanks (+1) for your comment. Right now I am the only one testing this (on different machines and browsers) and I can tell you that the Firefox 6.0.1 is running on a brand new Windows 7 netbook that didn't have a chance to be messed with. –  scatmoi Sep 4 '11 at 16:07
    
Are you in a position to share the domain name this is happening with? It's OK if you don't want to, it just might make troubleshooting easier. –  Ben Pilbrow Sep 4 '11 at 16:12
    
@Ben Pilbrow I am the one who purchased the certificate but I am not the one who installed it. Installation was performed by my webhost's support as it is on a shared web hosting account. My experience with these folks is that they sometimes need guidance, especially in difficult to troubleshoot situations like this one. I am trying to gather as much information as possible, so that it can be helpful not only for me, but also for future techs encountering this. So I would like to keep this as general as possible. –  scatmoi Sep 4 '11 at 16:22

4 Answers 4

up vote 6 down vote accepted

I had the same problem - bought a basic SSL certificate (from Network Solutions), installed it under nginx, and it worked fine in both Opera and IE - but not Firefox 3.6.12. This is how I solved the problem. Note that I have root/shell access to my VPS, I don't know if you do (at least this might point your providers in the right direction).

The first step in finding the solution was using Qualys (as per this other answer). It told me that the chain was incomplete.

Second, I used OpenSSL for testing/debugging. Assuming you have shell access, you can do the command (q or CTRL-C to disconnect):

openssl s_client -connect mysite.com:443

and you will probably see the error "unable to get local issuer certificate". This is also a way to test when it's working, in the shell, without running Firefox.

SSL Certificate Chains

Some browsers may complain about a certificate signed by a well-known certificate authority, while other browsers may accept the certificate without issues. This occurs because the issuing authority has signed the server certificate using an intermediate certificate that is not present in the certificate base of well-known trusted certificate authorities which is distributed with a particular browser. In this case the authority provides a bundle of chained certificates which should be concatenated to the signed server certificate. The server certificate must appear before the chained certificates in the combined file

Nginx configuration

In my case, I had gotten three files from Network Solutions - mysite.com.crt, AddTrustExternalCARoot.crt, and NetworkSolutionsDVServerCA.crt. There was no bundle file, but it's possible to create one from the other certificates. After some trial-and-error, I found what I needed was:

$ cat mysite.com.crt NetworkSolutionsDVServerCA.crt > mysite.com.chain.crt

The final step was to reconfigure my nginx server with the new file:

server {
    listen       443;
    ssl          on;
    ssl_certificate        /etc/ssl/certs/mysite.com.chain.crt;
    ssl_certificate_key    /etc/ssl/private/mysite.com.key;

    server_name  mysite.com;
    # and so on
}

After getting the right certificates in the bundle, and restarting nginx, openssl reported no errors, Firefox got the page with no problem, and Qualys reported the chain was valid.

Apache configuration

Since you're running Apache, then you (or your providers) need to configure it for SSL with the correct file locations, one of which is the missing intermediate chain file:

<VirtualHost 192.168.0.1:443>
    DocumentRoot /var/www/html2
    ServerName www.yourdomain.com
    SSLEngine on
    SSLCertificateFile /path/to/your_domain_name.crt
    SSLCertificateKeyFile /path/to/your_private.key
    SSLCertificateChainFile /path/to/DigiCertCA.crt
</VirtualHost>
share|improve this answer
    
The chainfile is easy to forget, make sure you include it guys. thanks for the answer cyclops –  andrewk Dec 22 '12 at 2:09

Are all of the browsers using the newest version of SSL? (3.0 I think)?

share|improve this answer
    
The SSL certificate is indeed version 3.0 and even the old IE6 identifies it as such. –  scatmoi Sep 4 '11 at 16:11

Try the following tests on your domain:

Qualys: https://www.ssllabs.com/ssldb/index.html

DigiCert: http://www.digicert.com/help/

I've found both very handy for pinning down random SSL certificate issues.

share|improve this answer
    
That first site (Qualys) is very useful. I'm having the same problem with Firefox, and previously tried DigiCert, who said my cert was fine. But Qualys says the chain is incomplete, so maybe something is missing after all. –  Cyclops Oct 24 '11 at 14:02

I use this for Nginx and StartSSL, it needs the class CA too:

cat ssl.pem ca.pem sub.class1.server.ca.pem > server.pem or cat ssl.pem ca.pem sub.class2.server.ca.pem > server.pem (according to your class level)

share|improve this answer
    
Regardless, the certificate likely expired by now ;-) –  Felix Frank Jun 20 at 12:51

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.