We have a need to deploy a server app that has its own SSL certificate built in. This will get rolled to an unknown number of servers, that will go up and down.
We can generate this certificate using any CA, but in the end, we will just have the 509 certificate pfx file (issued by godaddy or whatever CA). We can have in hand the intermediate certs, but this web server is simple, and only lets us specify the pfx file.
We won't be able to distribute or install intermediate certificates.
The app is a C# app that runs on Win2008 and higher.
What methods are there to solve this?
-- Is there a certificate that is reliable enough for browsers to trust it without intermediate certificates?
-- or ?
509 certificate pfx file
- this would include the public key as well as the private key; it's impossible for an SSL listener to function with only the private part of the certificate. Do you by chance mean that you'll only have the subject certificate and can't install an intermediate? Can you clarify why this restriction is in place?