Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am using Godaddy cert, normally I would concat the cert and make into a chained cert

cat www.example.com.crt sf_bundle.crt > chained.cert

And in my nginx.conf,

ssl_certificate chained.cert

In the browser I see the chain as below:

www.example.com
  Starfield Secure Certification Authority
    Starfield Technologies Inc.

That is fine, everything is working.

Today, I read a blog post form CloudFlare [1], it said:

The lowest hanging fruit in terms of reducing 
the size of these certificates was to remove the 
root certificates from the certificate bundle. 
There's no reason to include these since they should already be 
present in browsers and, even if they're not, the browser won't trust them.

So, does it mean I can remove the Starfield Technologies Inc. without affecting the validaity of my SSL cert and I can have a better performance?

[1] http://blog.cloudflare.com/what-we-just-did-to-make-ssl-even-faster

share|improve this question
1  
Is the root cert really found in your bundle? I would have expected that the bundle only contains the intermediate certificate ("Starfield Secure Certification Authority"), and you do actually need that one. Use openssl x509 -text to see what's really in the bundle. –  Celada Jan 27 '13 at 17:11
add comment

1 Answer

up vote 1 down vote accepted

It depends on what kind of entity has signed your certificate.

If it was signed directly by a root CA, then indeed there'd be little point in re-serving such root CA with your own web-server.

However, if it was issued by an intermediate CA, and you don't bundle that within your cert, then you risk the risk of having certain users receiving warnings about the certificate being broken, if they've never seen such an intermediate CA before.

http://superuser.com/a/524234/180573

How to know which situation you're in? You can test with http://www.digicert.com/help/?host=

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.