0

I've got a weird issue with a secure site, where some users reporting that their browsers are showing the site's SSL Certificate as being invalid.

The site is running on a dedicated server running Fedora 17 (i.e. no other virtual hosts are running on that particular web server) and the SSL is through GoDaddy.

The only thing that I can possibly think of as being a possible cause is that there are other (non-secure) domain names that point to the same IP Address, though they're being hosted on another machine. In this setup, I have two web servers with non-routable ips behind a router which has the dedicated public ip as its wan address. Depending on the port (80 or 443), the router forwards the requests to the appropriate web server.

The weird thing that's been confounding me is that the errors are only being reported from some people, not everyone, and I haven't been able to reproduce the issue myself. Are there any glaring issues with my setup and/or can someone suggest a way to even troubleshoot this problem?

3
  • 2
    Did you correctly configure your web server to send the intermediate certificates? (If you tell us the site name, we can probably figure out the problem instantly. Or use an SSL checker.) Dec 4, 2012 at 20:06
  • @DavidSchwartz Because of the nature of the website (it's a voting portal), I can't post the url, but thank you, SSL Checker reported that I need an intermediate certificate for "certain browsers". Checking it out now.
    – nageeb
    Dec 4, 2012 at 20:42
  • @DavidSchwartz You were right about the intermediate cert. I posted an answer below if only to help others who might have the same problem. Feel free to elaborate on your comment in an answer form and I'll gladly accept :)
    – nageeb
    Dec 4, 2012 at 21:02

2 Answers 2

2

There is a nice little description on how to check a certificate closer to your private vlan... http://www.cyberciti.biz/faq/test-ssl-certificates-diagnosis-ssl-certificate/

Sorry about putting this in the answer section...I do not see a "comment" button and I believe I need to get up to 50 reputation points to be able to comment. If somebody knows otherwise...I am all ears :-) I feel stupid "answering" when all I really want to do is comment.

1

Based on the information listed at SSL Checker, provided by @David Shwartz (big ups), the issue was that my Apache configuration only had the SSLCertificateFile and the SSLCertificateKeyFile directives defined and was missing the SSLCertificateChainFile directive, thus defining no intermediate Certificate defined. A good explanation (too long to quote here) can be found here.

The solution was to define the SSLCertificateChainFile in my virtual host configuration. So my

  • SSLCertificateFile /path/to/your/certificate/file
  • SSLCertificateKeyFile /path/to/your/key/file
  • SSLCertificateChainFile /path/to/intermediate/bundle/file

Everything looks good now!

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .