Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We just got a new SSL certificate from GoDaddy. And, while all browsers are fine with the certificate, Safari gives the following error:

This certificate was signed by an unknown authority.

We are using a chain file in the following config in Apache:

SSLEngine on
SSLCertificateFile /etc/apache2/ssl/godaddy.crt
SSLCertificateKeyFile /etc/apache2/ssl/godaddy.key
SSLCertificateChainFile /etc/apache2/ssl/gd_bundle2.crt

Looking around the web, it seems that others have experienced this issue as well (http://blog.boxedice.com/2009/05/11/godaddy-ssl-certificates-and-cannot-verify-identity-on-macsafari/) But no solution seems to fix the issue.

Does anyone know why this would be caused, or have experience with this happening, and how to fix it?

share|improve this question

5 Answers 5

up vote 8 down vote accepted

Verify that the correct intermediate certificates are being given out by the server at http://www.sslshopper.com/ssl-checker.html

As martona suggested, you may need to use a different bundle.

share|improve this answer
    
Tried the ssl checker and everything seems to be fine... –  Zed Said Nov 23 '09 at 5:57
    
What version of Safari and Mac OS X do you have? Maybe an update will help? Check to see if you have the last certificate that is given out by the server in the SSL checker in your MAC OS X keychain. –  Robert Nov 23 '09 at 15:49
    
+1 -- that is a handy tool. –  Clinton Blackmore Nov 24 '09 at 17:51

You may be using the wrong cert chain. I assume your "gd_bundle2.crt" is the same as "gd_bundle.crt" on this page: https://certs.godaddy.com/anonymous/repository.seam

That gd_bundle.crt chain has a "Go Daddy Class 2 Certification Authority" that verifies up to a Valicert root. I don't think this is valid anymore - GoDaddy seems to issue certs that are signed by "Go Daddy Secure Certification Authority" that is in turn signed by a different, self-signed "Go Daddy Class 2 Certification Authority" - not the Valicert-issued one in your chain, so it has nothing to do with your actual certificate.

Go to the page referenced above, download "gd-class2-root.crt" then download "gd_intermediate.crt". Concatenate the two files (they're just plain text files) into "mybundle.crt" and specify this new file in SSLCertificateChainFile. See if that makes a difference.

share|improve this answer
    
Thanks, I will give this a try and post back here. –  Zed Said Nov 18 '09 at 4:35
    
@Zed Said, did this work for you? –  Stefan Lasiewski Feb 1 '11 at 21:41
    
I just tried this, and it worked for me... thanks! –  Brad Parks Sep 4 '12 at 16:19

Not quite a solution to the actual problem at hand, but it is quirks like this that cause me to always buy my SSL certs from Thawte.

share|improve this answer
    
Thanks Brian. I'll keep Thawte in the back of my mind. –  noloader Dec 24 '12 at 2:44

For some reason Safari doesn't stay up to date with the latest trusted root certification authorities. You can contact customer service and ask them to reissue you a certificate with a different trusted root certificate.

share|improve this answer

I encountered this issue when adding a StarField (wildcard) SSL certificate to Apache on HPUX when using sf_bundle.crt as my chain cert. I replaced it with the more generic sf_intermediate.crt (from https://certs.starfieldtech.com/anonymous/repository.seam) as the SSLCertificateChainFile, which resolved the Safari "unknown authority" issue for me.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.