Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

A server on my network is signed with a certificate issued by RapidSSL CA but does not supply to complete issuer chain (RapidSSL CA's certificate is issued by GeoTrust CA which is a trusted root authority).

When I access the site using firefox I get the following error:

The certificate is not trusted because no issuer chain was provided.
(Error code: sec_error_unknown_issuer)

But if I connect to the site using IE or chrome it works and I noticed that RapidSSL is then loaded as a Intermediate CA afterwards. I don't understand how Chrome/IE (I assume it uses the Windows Certificate store) knows to add RapidSSL as intermediate CA.

I get the expected behaviour (according to me) when I use openssl s_client to debug the connection.

I get the following when only using GeoTrust as CA:

Verify return code: 21 (unable to verify the first certificate)

Using only RapidSSL as CA:

Verify return code: 2 (unable to get issuer certificate)

When using both:

Verify return code: 0 (ok)

Can anyone help me understand how Windows knows to load RapidSSL CA as intermediate authority?

share|improve this question

2 Answers 2

up vote 3 down vote accepted

CA certificates are downloaded based on URL information in the Authority Information Access (AIA) extension of the issued certificates.

Firefox, last I heard, uses its own certificate store and/or chaining engine. Chrome and IE use the one in Windows.


Certificate Validation Process

When a certificate is presented to an application, the application must use the certificate chaining engine to determine the certificate’s validity. Only after the certificate chain is successfully validated can the application trust the certificate and the identity represented by the certificate. Three distinct but interrelated processes are used to determine a certificate’s validity:

Certificate discovery To build certificate chains, the certificate chaining engine must collect the issuing CA certificate and all CA certificates up to the root CA certificate. CA certificates are collected from the CryptoAPI cache, Group Policy, or Enterprise Policy, or, as a last resort, downloaded from Authority Information Access (AIA) Uniform Resource Locators (URLs) in issued certificates. Once a certificate is downloaded from a location other than the CryptoAPI cache, it is added to the user’s CryptoAPI cache for faster retrieval.

Path validation When the certificate chaining engine validates a certificate, it does not stop at the presented certificate. Each certificate in the certificate chain must be validated until a self-signed root certificate is reached. Validation tests can include verifying authenticode signatures, determining whether the issuing CA certificate is included in the NTAuth store, or the inclusion of specific application or certificate policy object identifiers (OIDs). If one certificate fails the validity test, it is possible that the entire chain will be deemed invalid and not used by the calling application.

share|improve this answer
    
Thank you for your answer, exactly what I was looking for. Does this mean Firefox's chaining engine doesn't use the the Authority Information Access URL to complete the chain? Or might it be a network error preventing Firefox from accessing it? –  Wilhelm Kleu Nov 16 '12 at 5:13
    
Good question. I really don't know. Firefox is popular enough that I'm sure that there are no glaring problems in the way it handles certificates... I was just answering your question about how Windows knows how to automatically find and download needed certs. :) –  Ryan Ries Nov 16 '12 at 14:16

It is indeed the different certificate store. The intermediates are only needed on apps that don't already have those certs built in. The issuer CA is included in every certificate. The only question is if that issuer cert is trusted. Adding the intermediates helps on software with a smaller set of trusted certs installed by default. .

share|improve this answer
    
I don't think I understand your answer. If I remove RapidSSL as Intermediate CA (thus only GeoTrust CA is a trusted CA) and connect using IE/Chrome it automatically adds RapidSSL as Intermediate CA. GeoTrust CA is trusted by both Firefox and Windows (I checked and the certificates are identical when exported). –  Wilhelm Kleu Nov 15 '12 at 13:40

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.