I have a company.sv domain and recently purchased a RapidSSL wildcard certificate, I installed it and tested it with many browsers(Firefox, Chromium, Chrome, IE) and SSL checking tools, it worked fine on every one except on Google Chrome in neither Windows, Linux and Android.

Every time I access the website through Google Chrome it show a warning saying that I tried to access www.company.sv or whatever.company.sv but the server identifies itself as **.company.sv*. If I continue despite the warning and click the red lock, it tells me that I'm connected to a server that is only valid inside my network and can't be validated through an external certification entity.

I contacted the certificate re-seller's support service but they couldn't give me a straight answer about what was the problem. I've been wondering if it has something to do with TLD being .sv. I've also checked the Chromium source code but it seems kinda pointless since the certificate works flawlessly on Chromium.

Maybe it's worth mentioning that I'm using NGINX on a Ubuntu 12.04 Server and that I tested a free single-domain certificate from Comodo before purchasing the wildcard one.

  • 1
    It may help to include the domain, if you are able, so that people answering can query the server directly. – Ladadadada Dec 5 '13 at 19:25

It sounds like you forgot to install the intermediate certificate bundle on your web server. Visit the certificate vendor's web site to download the intermediate bundle.

For nginx, this must be concatenated with your certificate and placed in the ssl_certificate directive, for instance:

# cat company.sv.crt ca_bundle.crt > company.sv.chained.crt

And in your nginx config:

ssl_certificate /etc/path/to/company.sv.chained.crt
  • The intermediate certificates are fine, that's one the first suggestions I got from tech support. I investigated a bit more and apparently there's a bug in Google Chrome since it works just fine in the beta (32.0) and dev/Canary (33.0) – Rafael V. Dec 5 '13 at 22:01
  • Is there a specific order in the chained certificate ? – JulienFr Jan 12 '14 at 12:46

I suspect that you have the site name in the Subject CN= field, it needs to be in the subject alternate name field for Chrome to accept it. if you display the certificate in the browser, or with openssl x509 -in certificate-file -text

See: this blog post or this link

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.