2

I've been getting reports of users visiting our site getting "this certificate is not trusted" errors when visiting our site via https. I don't seem to ever have any problems, but two separate people on my team have gotten this error randomly when they're on a different wifi network other than the one at our office. They don't have the same problem at the office.

I read up on intermediate certificates but this seems to be just a browser thing, not a network related issue.

I have an SSL cert from GoDaddy, it's on a Rails app running on nginx + unicorn.

Does anyone have any other ideas why this might happen? I'm pretty stumped.

I do get the below (redacted) when running openssl s_client -connect $hostname:443.

CONNECTED(00000003) depth=2 C = US, O = "The Go Daddy Group, Inc.", OU = Go Daddy Class 2 Certification Authority verify error:num=19:self signed certificate in certificate chain verify return:0

  • are your sure all your resources are referenced through //fqdn/uri (without the protocol, the browser should get the actual proto)? – Marcel Apr 1 '14 at 18:28
  • not all of them are -- but wouldn't this just provide a warning and not an untrusted certificate error? – Calvin Apr 1 '14 at 18:30
  • Depends...what's the error they're getting? The browser should say why it's untrusted. – Nathan C Apr 1 '14 at 18:32
  • via Chrome: "The identify of this website has not been verified. Server's certificate is not trusted." – Calvin Apr 1 '14 at 18:33
  • It's possible that the wifi they're connecting via does some man-in-the-middle proxying thing. Hard to tell based on this info, though; it would help if one of the users could check with openssl s_client -connect $hostname:443 when they get the error. – Jenny D says Reinstate Monica Apr 1 '14 at 18:35
3

This issue is related to adding the entire certificate chain -- for me, I needed to concatenate a gd_bundle.crt file into my distributed certificate and re-upload it to the server. I was able to verify that it worked by using an online SSL checker.

  • 1
    The reason the errors didn't show for you is probably that you had the chain certificate cached in your browser (from visiting some other site). – Dan Pritts Apr 2 '14 at 3:42
1

I assume you already know how SSL/TLS works: SSL certificates have to be signed by a trusted authority (CA) and trusted authorities have implemented their public keys (root certificates) into browser software. The private keys of trusted authorities became quite valuable and a loss would be a maximum credible accident. Therefore trusted authorities (CA) have locked their private keys away and do not use them to sign common certificate requests of their customers. For that purpose they use sub certificates and sub sub certificates (we call them intermediate certificates).

Your browser is able to see that chain of trust (your certificate -> intermediate certificate #2 of the CA -> intermediate certificate #1 of the CA -> root certificate of the CA) and follow it.

Actually most certificates provide more than one chain of trust. This is a fall-back in case browsers do not have the correct root certificate implemented.

To allow most browsers to follow your chain of trust you have to concatenate your servers certificate and all required intermediate certificates into one big text file. Restart your server and test with OpenSSL if the chains of trust of your certificate is working.

If you are not familiar with OpenSSL you can use the Qualys SSL Labs website. Here you can see if all provided chains of trust are working as well as other pretty useful information about your SSL/TLS set-up.

0

You can add a PEM file containing the GoDaddy trust chain in the SSLCertificateChainFile directive in your vhost config.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.