Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

On http://www.whynopadlock.com/check.php whilst testing the following url https://www.bobclubs.com/pay I get the following message:-

ERROR: cannot verify www.bobclubs.com's certificate, issued by `/C=US/O=GeoTrust, Inc./CN=RapidSSL CA': Unable to locally verify the issuer's authority.

I am not 100 sure why this is as all issuer is OK, all items are secure and I get a padlock on all browsers.

No pad lock message

Can any one shed some light on this?

share|improve this question

3 Answers 3

up vote 3 down vote accepted

most probably you did not install intermediate certificate included in message you've received from rapid ssl. take a look here.

share|improve this answer
    
Since the site works in a browser, that's evidently not the problem. –  Jenny D Jul 4 '12 at 9:22
2  
not necessarily. i use rapidssl as well and saw validating tools failing and browsers not warning. –  pQd Jul 4 '12 at 9:33
    
@pQd A good example is mobile devices which don't update their cert storage as Android <2.2 did when Geotrust and RapidSSL changed their root cert. –  Shadok Jul 4 '12 at 9:50
    
Firefox has the CA certs for both RapidSSL and GeoTrust CA. That means that the chain will work all the way back to GeoTrust even if the server doesn't present the GeoTrust cert. If you remove the RapidSSL cert from the browser's list of CA certs, the browser will give you a warning. You can test this easily with openssl verify, too. –  Jenny D Jul 4 '12 at 10:02
    
@jenny D - can you please tell then what's the point of intermediate cert? thx! –  pQd Jul 4 '12 at 21:38

Presumably, whatever list of trusted CA certificates that whynopadlock.com uses does not include the CA certificate at the root of the trust chain used by your certificate. Given that you claim that browsers seem to trust the certificate, then I'd say it's a limitation of the testing site.

share|improve this answer

It looks like you did not setup the intermediate certificate correctly.
Most browsers will still show the lock in this situation.

Take a look at this verifier from rapidssl:
https://knowledge.rapidssl.com/support/ssl-certificate-support/index?page=content&id=SO9556

And fix by following this document (Apache):
https://knowledge.rapidssl.com/support/ssl-certificate-support/index?page=content&id=SO6252&actp=LIST&viewlocale=en_US

Or this one (IIS):
https://knowledge.rapidssl.com/support/ssl-certificate-support/index?page=content&id=SO10517&actp=LIST&viewlocale=en_US

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.