Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I recently swapped my sites SSL certificate over to a new Thawte 2048 bit cert.

Ubuntu/libcurl doesn't seem to be able to verify it. Web browsers and OSX is fine.

I had to manually update the cert bundle on the OS from here:

https://search.thawte.com/support/ssl-digital-certificates/index?page=content&actp=CROSSLINK&id=AR1374

Any ideas why Ubuntu doesn't have these?

Thank you

Mark

share|improve this question

1 Answer 1

up vote 4 down vote accepted

Instead of explicitly trusting the intermediate certificates, you should have your web server send the full certificate chain so that a client's trust of the root (not the intermediate) will allow them to validate.

Importing the intermediate manually may fix it on your system, but other people using that OS or others that don't have the intermediate (often phones are problematic) will still have problems.

What web server software are you using?

share|improve this answer
    
Ahh, your fingers are faster than mine. Have a +1 instead, because I completely agree. –  MadHatter Dec 6 '12 at 16:21
    
It's an F5 BigIP –  markba Dec 6 '12 at 16:26
1  
@markba They have a document on how to set it up to send the full chain, looks like you basically just need import the chain and configure it for use - see here. –  Shane Madden Dec 6 '12 at 16:34
    
All fixed - thanks everyone. –  markba Dec 6 '12 at 16:48

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.