Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

On whilst testing the following url I get the following message:-

ERROR: cannot verify's certificate, issued by `/C=US/O=GeoTrust, Inc./CN=RapidSSL CA': Unable to locally verify the issuer's authority.

I am not 100 sure why this is as all issuer is OK, all items are secure and I get a padlock on all browsers.

No pad lock message

Can any one shed some light on this?

share|improve this question
up vote 3 down vote accepted

most probably you did not install intermediate certificate included in message you've received from rapid ssl. take a look here.

share|improve this answer
Since the site works in a browser, that's evidently not the problem. – Jenny D Jul 4 '12 at 9:22
not necessarily. i use rapidssl as well and saw validating tools failing and browsers not warning. – pQd Jul 4 '12 at 9:33
@pQd A good example is mobile devices which don't update their cert storage as Android <2.2 did when Geotrust and RapidSSL changed their root cert. – Shadok Jul 4 '12 at 9:50
Firefox has the CA certs for both RapidSSL and GeoTrust CA. That means that the chain will work all the way back to GeoTrust even if the server doesn't present the GeoTrust cert. If you remove the RapidSSL cert from the browser's list of CA certs, the browser will give you a warning. You can test this easily with openssl verify, too. – Jenny D Jul 4 '12 at 10:02
@jenny D - can you please tell then what's the point of intermediate cert? thx! – pQd Jul 4 '12 at 21:38

Presumably, whatever list of trusted CA certificates that uses does not include the CA certificate at the root of the trust chain used by your certificate. Given that you claim that browsers seem to trust the certificate, then I'd say it's a limitation of the testing site.

share|improve this answer

It looks like you did not setup the intermediate certificate correctly.
Most browsers will still show the lock in this situation.

Take a look at this verifier from rapidssl:

And fix by following this document (Apache):

Or this one (IIS):

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.