15

My site is https://blendbee.com. It's using a PositiveSSL certificate that is valid.

In Windows 8 Chrome the certificate is fine (green lock in top left corner).

But...on my Android, it's not so fine. Screenshot: http://postimg.org/image/6vc64lr1d/

Any ideas why?

The server is running Ubuntu 13.10 at Digital Ocean.

3
  • IIRC, some Comodo certificates are not trusted in old Android (2.x) versions.
    – ceejayoz
    Aug 14, 2014 at 21:05
  • 1
    Reproduced on KitKat 4.4.4. So it's not a case of old Android. Aug 14, 2014 at 21:06
  • 2
    Yep, this was on my Samsung Galaxy S5
    – Kane
    Aug 14, 2014 at 21:21

3 Answers 3

16

You need to provide the entire certificate chain in order for it to show up as trusted.

Here's the link I got for comodo's instructions on installing the cert chain in apache: https://support.comodo.com/index.php?/Default/Knowledgebase/Article/View/637/37/certificate-installation-apache--mod_ssl

I got this from http://www.sslshopper.com/ssl-checker.html#hostname=blendbee.com, which flagged your cert as not being trusted in all browsers because of an incomplete chain.

1
4

A certificate can contain a special Authority Information Access extension (RFC-3280) with URL to issuer's certificate. Most browsers can use the AIA extension to download missing intermediate certificate to complete the certificate chain. But some clients (mobile browsers, OpenSSL) don't support this extension, so they report such certificate as untrusted.

You can solve the incomplete certificate chain issue manually by concatenating all certificates from the certificate to the trusted root certificate (exclusive, in this order), to prevent such issues. Note, the trusted root certificate should not be there, as it is already included in the system’s root certificate store.

You should be able to fetch intermediate certificates from the issuer and concat them together by yourself. I have written a script to automate the procedure, it loops over the AIA extension to produce output of correctly chained certificates. https://github.com/zakjan/cert-chain-resolver

0
-1

Neither the root nor the intermediate certificate are trusted by Chrome, which I believe uses Android's native CA set. That set is viewable from settings->security->Trusted credentials.

This question over ad android.se, might help further.

1
  • The root cert. was in the trust store, but not the intermediate cert. The cert. chain containing all the intermediates was not included and the client was not climbing up the chain using the Authority Information Access extension (possibly because the information was not included in the cert. as presented by the server) to see if the chain led to a trusted CA.
    – austinian
    Sep 15, 2016 at 17:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .