Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Have been trying to get Ubuntu to recognize the GeoTrust SAN certificate, no luck. Browsers work fine. Help?

$ openssl s_client -showcerts -connect artsyapi.com:443
CONNECTED(00000003)
depth=0 businessCategory = Private Organization, 1.3.6.1.4.1.311.60.2.1.3 = US, 1.3.6.1.4.1.311.60.2.1.2 = Delaware, serialNumber = 4660944, C = US, ST = New York, L = New York, O = Artsy Inc., CN = artsy.net
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 businessCategory = Private Organization, 1.3.6.1.4.1.311.60.2.1.3 = US, 1.3.6.1.4.1.311.60.2.1.2 = Delaware, serialNumber = 4660944, C = US, ST = New York, L = New York, O = Artsy Inc., CN = artsy.net
verify error:num=27:certificate not trusted
verify return:1
depth=0 businessCategory = Private Organization, 1.3.6.1.4.1.311.60.2.1.3 = US, 1.3.6.1.4.1.311.60.2.1.2 = Delaware, serialNumber = 4660944, C = US, ST = New York, L = New York, O = Artsy Inc., CN = artsy.net
verify error:num=21:unable to verify the first certificate
verify return:1
---
Certificate chain
 0 s:/businessCategory=Private Organization/1.3.6.1.4.1.311.60.2.1.3=US/1.3.6.1.4.1.311.60.2.1.2=Delaware/serialNumber=4660944/C=US/ST=New York/L=New York/O=Artsy Inc./CN=artsy.net
   i:/C=US/O=GeoTrust Inc/OU=See www.geotrust.com/resources/cps (c)06/CN=GeoTrust Extended Validation SSL CA
-----BEGIN CERTIFICATE-----
MIIFfDCCBGSgAwIBAgICUFIwDQYJKoZIhvcNAQEFBQAwgYUxCzAJBgNVBAYTAlVT
MRUwEwYDVQQKEwxHZW9UcnVzdCBJbmMxMTAvBgNVBAsTKFNlZSB3d3cuZ2VvdHJ1
c3QuY29tL3Jlc291cmNlcy9jcHMgKGMpMDYxLDAqBgNVBAMTI0dlb1RydXN0IEV4
dGVuZGVkIFZhbGlkYXRpb24gU1NMIENBMB4XDTEzMDExNzIxMTE0N1oXDTE0MDEy
MDExMTAxM1owgb0xHTAbBgNVBA8TFFByaXZhdGUgT3JnYW5pemF0aW9uMRMwEQYL
KwYBBAGCNzwCAQMTAlVTMRkwFwYLKwYBBAGCNzwCAQITCERlbGF3YXJlMRAwDgYD
VQQFEwc0NjYwOTQ0MQswCQYDVQQGEwJVUzERMA8GA1UECBMITmV3IFlvcmsxETAP
BgNVBAcTCE5ldyBZb3JrMRMwEQYDVQQKEwpBcnRzeSBJbmMuMRIwEAYDVQQDEwlh
cnRzeS5uZXQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDoN6pmvv8V
6BhF4gRMzMV+5sSjQDNrhyqV2NMdDOzwqoTHGVMvyD+AJC9kaP6WmH/S8MlA6LmW
b/Z0RvDplD6Wvyoz5MJsHaeCwVThOs1fVLY4PYMky154515RF9H1rui4nz3KXUfP
bm6MeAZY7FStRM/Uep9LhewR/qXEfLocNEfb92piTJ/UtsiLtTbfeZKYxFe/IpMO
EMADQmhEBEXOq2ozcvwnwNBDHwApxhE88z2/mzUTHZl40fLnWI4S2tSVZZwOI45p
VMiu3XwVwzCCMmosm5k3B3l6swFlSOH+WDUTwEbnmxa4HRdQWAIFHsT3cTT28VyW
LIAbw8lSstKjAgMBAAGjggG6MIIBtjAfBgNVHSMEGDAWgBQoxOuP8V95kKMrVcNW
Tn1rU3IsGDBuBggrBgEFBQcBAQRiMGAwKgYIKwYBBQUHMAGGHmh0dHA6Ly9FVlNT
TC1vY3NwLmdlb3RydXN0LmNvbTAyBggrBgEFBQcwAoYmaHR0cDovL0VWU1NMLWFp
YS5nZW90cnVzdC5jb20vZXZjYS5jcnQwDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQW
MBQGCCsGAQUFBwMBBggrBgEFBQcDAjBVBgNVHREETjBMghBzZWN1cmUuYXJ0c3ku
bmV0gg13d3cuYXJ0c3kubmV0ggxhcnRzeWFwaS5jb22CEHd3dy5hcnRzeWFwaS5j
b22CCWFydHN5Lm5ldDBCBgNVHR8EOzA5MDegNaAzhjFodHRwOi8vRVZTU0wtY3Js
Lmdlb3RydXN0LmNvbS9jcmxzL2d0ZXh0dmFsY2EuY3JsMAwGA1UdEwEB/wQCMAAw
SwYDVR0gBEQwQjBABgkrBgEEAfAiAQYwMzAxBggrBgEFBQcCARYlaHR0cDovL3d3
dy5nZW90cnVzdC5jb20vcmVzb3VyY2VzL2NwczANBgkqhkiG9w0BAQUFAAOCAQEA
owIpFaZH6wTdC05Bs++zElThmUdPuh2g9JXGjt8vWcZZg929s5I+grNIw1YEU5AC
aZBvw/imGFYECuVBbLZt3EGYewkFlUfVPcprVhHDDYZASlddN71fR/N9w4Y+A1io
sYS+yBjYOEpP8fTJAHkRK9nhqQ3/lnMQoFdy4yt/YL/k14dX9uFjoQuts1TLOwdk
VfCe/F/+Xme9WUZY2l9TE+TsqMg33C2O+Of/Im5rH+RkkkfE8nyzLMjWVGrofhiJ
jUw294H52QnouV/EPnzQgHmKmlb0AjqwG2zwFM2LlcJIEeZVLQ64mRyLENYN8TeZ
PcoaJf0Y9Qhecr51uvdwtQ==
-----END CERTIFICATE-----
---
Server certificate
subject=/businessCategory=Private Organization/1.3.6.1.4.1.311.60.2.1.3=US/1.3.6.1.4.1.311.60.2.1.2=Delaware/serialNumber=4660944/C=US/ST=New York/L=New York/O=Artsy Inc./CN=artsy.net
issuer=/C=US/O=GeoTrust Inc/OU=See www.geotrust.com/resources/cps (c)06/CN=GeoTrust Extended Validation SSL CA
---
No client certificate CA names sent
---
SSL handshake has read 2275 bytes and written 440 bytes
---
New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-SHA
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1.1
    Cipher    : DHE-RSA-AES256-SHA
    Session-ID: DB973C054A9552ED83D591518D0F81E77AC548CE91450602E3C72ACCDD1C2E8E
    Session-ID-ctx: 
    Master-Key: AEB7BC9F1077B2BE36D9E5020D873736227A9BE9271F673AA8825073FEA96CA6C37AC41E75C8B56F07220A205B49ADB9
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 300 (seconds)
    TLS session ticket:
    0000 - e3 e1 6d 3e 5e 73 78 88-0e a2 79 e1 cf 05 91 90   ..m>^sx...y.....
    0010 - 07 90 cb 53 60 be 78 85-c3 08 b0 a6 8e ae d0 7b   ...S`.x........{
    0020 - 7c 71 d4 b8 a8 40 29 14-dc d2 12 39 a0 1d f0 fa   |q...@)....9....
    0030 - 3d d7 9b 6a cb fe 87 29-5f b6 d4 94 d2 4a e3 d4   =..j...)_....J..
    0040 - b2 f5 db ed d3 c3 43 2a-7a 64 65 8e bd 7a e6 46   ......C*zde..z.F
    0050 - d5 b6 5e da ee 09 e0 50-24 ec 3e 17 c4 90 b9 16   ..^....P$.>.....
    0060 - 7e 60 c5 f5 50 03 f9 b4-41 5b 6c 13 6d 75 e9 7c   ~`..P...A[l.mu.|
    0070 - 2c a5 2b 48 b0 06 61 06-90 99 ed 97 f6 db f9 b2   ,.+H..a.........
    0080 - 4c 35 7e 7e 87 a0 92 41-b6 f4 16 35 d9 af de b4   L5~~...A...5....
    0090 - 19 11 0d 92 38 b9 a8 d2-f6 e7 0b d5 aa f9 90 7b   ....8..........{

    Start Time: 1368999775
    Timeout   : 300 (sec)
    Verify return code: 21 (unable to verify the first certificate)
share|improve this question
    
What have you done to try and get ubuntu to recognise the cert? –  Cian May 20 '13 at 0:05

2 Answers 2

up vote 2 down vote accepted

This worked:

The 2 certificates provided by RapidSSL as the "certificate chain" were removed from the CA file (declared in nginx config as ssl_client_certificate) and appended to the certificate file (declared as ssl_certificate) instead.

To put it another way, the final config looks like:

 ssl_certificate /etc/nginx/ssl/artsyapi.com/crt;  # original cert plus 2 from chain
 ssl_certificate_key /etc/nginx/ssl/artsyapi.com.key;  # key (unchanged)
 ssl_client_certificate /etc/nginx/ssl/artsyapi.com.ca;  # now empty
share|improve this answer
1  
And the instructions on knowledge.rapidssl.com/support/ssl-certificate-support/… for nginx are correct. They tell you to take your .crt and concatenate the certificate chain, then install that as the cert (the first line in your response). –  dB. May 20 '13 at 16:54

I suspect you're missing the root cert from your certificate store. You need to download the root geotrust cert, copy it to /etc/ssl/certs/, and then run c_rehash in that directory.

share|improve this answer
    
With some debugging it seems that the problem is the intermediate certificate, not the root. I don't think this would help at all. –  dB. May 20 '13 at 15:01
    
Have you tried adding the intermediate cert to /etc/ssl/certs? –  Cian May 20 '13 at 15:17
    
Cian, see the accepted response above. –  dB. May 20 '13 at 16:55

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.