A server on my network is signed with a certificate issued by RapidSSL CA but does not supply to complete issuer chain (RapidSSL CA's certificate is issued by GeoTrust CA which is a trusted root authority).
When I access the site using firefox I get the following error:
The certificate is not trusted because no issuer chain was provided.
(Error code: sec_error_unknown_issuer)
But if I connect to the site using IE or chrome it works and I noticed that RapidSSL is then loaded as a Intermediate CA afterwards. I don't understand how Chrome/IE (I assume it uses the Windows Certificate store) knows to add RapidSSL as intermediate CA.
I get the expected behaviour (according to me) when I use openssl s_client
to debug the connection.
I get the following when only using GeoTrust as CA:
Verify return code: 21 (unable to verify the first certificate)
Using only RapidSSL as CA:
Verify return code: 2 (unable to get issuer certificate)
When using both:
Verify return code: 0 (ok)
Can anyone help me understand how Windows knows to load RapidSSL CA as intermediate authority?