0

i install SSL certificate in my web site and now i have some questions about it. my web site is working correctly in google chrome web browser but it's not working in firefox browser. one of my friend is say's me the CA Root Trust certificate is not installed in the server. now i need to know how can i confirm the CA Root Trust is not installed and how to install CA Root Trust certificate in Cent OS 6.4 minimal with Apache. my SSL certificate issued AlphaSSL and it's domain validating wildcard certificate CA - G2. thank you very much for prompt reply !

0

Installing an extra root certificate on the server is not going to help a browser trust the server certificate the server sends it. The browser needs the root certificate locally in order to construct the chain of trust when the server sends it the certificate.

If you check the certificate dialogs in Chrome and Firefox I believe you will discover that Chrome has found the root CA installed locally and has constructed a correct valid chain whereas firefox has failed to do the same (because it does not have the necessary root CA locally).

Installing root CA certificates in browsers is a fairly simple process once you have the appropriate certificate file. The certificate dialogs in the various browsers all have an 'import' button of some sort that you can use for this task.

If your certificate requires intermediate certificates then those should, for best compatibility and correctness, be sent by the server during the SSL handshake process. That requires the intermediate certificates to be configured on the server the same way as the server certificate is (that is they must exist in a file and Apache must be pointed at that file with the SSLCertificateChainFile (or similar) directive).

2
  • here is the google chrome SSL chain. please can you help me to correct the issue in firefox. s8.postimg.org/fn13sdsut/SSL_chain.jpg – user196824 Oct 31 '13 at 3:02
  • If you look at the firefox certificate dialog can you find either of those certificates in the list of trusted CAs? You might discover that you can find the GlobalSign CA but not the 'AlphaSSL CA-G2' in the firefox list in which case you can either add that certificate to firefox (or more appropriately, and likely what your friend was trying to suggest) you can give that certificate to the server and that will let firefox use it correctly. – Etan Reisner Oct 31 '13 at 3:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy