Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

My site works well on every browser and device, except on Android, where it throws a security exception. I already installed my SSL certificate on my Amazon Elastic Beanstalk instance (by installing the certificate on the load balancer).

It seems that I can be falling on the following case:

http://blog.michaelfmcnamara.com/2011/07/googleandroid-root-and-intermediate-certificate-issues/

It seems that I have to install a intermediate certificate.

Can anyone help me with that? I dont really know what it means

share|improve this question

2 Answers 2

Concatenate the files provided manually, in the following order:

  • site.com.crt
  • intermediate.crt (one or more, the order of these doesn't matter)
  • ROOT.crt

you can do this from a shell with the cat command

cat site.com intermediate.crt ROOT.crt > site.chain.pem

or copy/paste them, no whitespace between, make sure certificates are on different lines

-----BEGIN CERTIFICATE-----
site cert
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
intermediate cert
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
root cert
-----END CERTIFICATE-----

If you don't have the root, concatenate the site cert with the intermediates, without root the cert. Such as:

-----BEGIN CERTIFICATE-----
site cert
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
intermediate cert
-----END CERTIFICATE-----

How do I Install Intermediate Certificates (in AWS)?

share|improve this answer
    
site.com is the certificate that I am already using ? Where is the Root cert? Do I have to download from the CA? –  Tony Nov 5 '13 at 17:17
    
If you don't have the root, just concatenate the intermediate cert to the site cert and then upload. –  Brian Knight Nov 5 '13 at 17:20
    
I got this message from Amazon 400 MalformedCertificate Invalid Public Key Certificate. –  Tony Nov 5 '13 at 19:13
    
Does your file look like the update I added above for site cert + intermediate cert? –  Brian Knight Nov 5 '13 at 19:20
    
yes.... -----BEGIN CERTIFICATE----- A LOT OF STUFF -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- ALOT OF STUFF -----END CERTIFICATE----- –  Tony Nov 5 '13 at 19:24

Sounds like you need to upload the intermediate certificate as well to prove it has been signed by a root authority. You must do something like the following using the AWS command line tools:

iam-servercertupload -b mydomain.crt -k mydomain.nopass.key -c my_intermediate_cert.crt -s mydomain

Alternatively, it can be done through the GUI control panel. Whoever you purchased the cert from should be able to provide the appropriate intermediate cert(s).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.