I have a certificate file provided to me which is a wildcard domain name. It comes as both a key and a crt file. No other files were provided.

I'm having trouble getting it to work correctly with the elastic load balancer.

I've tried this order:

http://www.networksolutions.com/support/installation-of-an-ev-ssl-certificate-for-tomcat-apache/

With the intermediate certs obtained from here: http://www.networksolutions.com/support/where-can-i-locate-the-network-solutions-nsprotect-root-and-intermediate-certificate-files/

I've also tried the following:

  • Network Solutions Add Trust External CA Root
  • Network Solutions UTN Add Trust CA
  • Network Solutions UTN Server CA
  • Network Solutions Extended Validation (EV) CA
  • Network Solutions Intermediate Certificate
  • Network Solutions EV Root

The error that the ELB returns is:

Unable to validate certificate chain. The certificate chain must start with the immediate signing certificate, followed by any intermediaries in order. The index within the chain of the invalid certificate is: -1

There is so much conflicting and outdated information out there and nothing seems to work. How do I get this working?

Is there a method I can use with OpenSSL to manually work it out what certificates I need at each step?

  • what web server software (apache?) and version are you running on your ec2 instances? There's not much to it if you find the proper syntax for your config file to reference the key, cert, and intermediate file, and you should be good. – user16081-JoeT Nov 11 '14 at 3:59
  • 1
    @user16081-JoeT the issue here is not with the web server. OP is trying to configure an AWS Elastic Load Balancer (not the web server) with an SSL cert, key, and chain, for SSL offloading. ELB validates everything when you add a cert, and OP seems to be missing a component or does not have them ordered correctly. – Michael - sqlbot Nov 11 '14 at 13:30
  • Exactly. Is there a way to work out the cert chain order piece by piece using SSL? – Matt Nov 11 '14 at 18:28
up vote 8 down vote accepted

I just ended up working this out, the correct order for the certificate chain is as follows:

OV_NetworkSolutionsOVServerCA2
OV_USERTrustRSACertificationAuthority
AddTrustExternalCARoot

Good luck!

  • Thanks, yeah I figured this out about 5 days ago. Your answer came in late but is the only one listed and is right. – Matt Nov 24 '14 at 23:08

Please make sure that whether your certificate chain contains the intermediate and Root certificates in the proper order.

The best way to analyze the problem with the chain certificate I was found here: Wormly Test SSL Web Server.

I have started the Amazon ELB SSL configuration for my domain here: SSL Certificate for Elastic Load Balancing.

I am using COMODO Instant SSL certificates. So, I got the bundle of the certificates in a zip file. When I extracted, it contains four files inside it like:

             1.AddTrustExternalCARoot {Root certificate}
             2.COMODORSAAddTrustCA    {intermediate certificate 1}
             3.COMODORSADomainValidationSecureServerCA {intermediate certificate 2}
             4.www_example_com   {public key for my domain name}

Note: We need to convert the above certificate file into .PEM format, before using it in Amazon ELB. This is done by using the command:

             openssl x509 -inform PEM -in {above certificate file name}

Now I went to Listeners part of ELB to configure HTTPS. ELB HTTPS have three brackets called:

             1.Private Key {paste the private key which was generated using openSSL}
             2.Public Key Certificate {paste the public key of www_example_com certificate}
             3.Certificate Chain {paste the intermediate and Root certificate}

In the first attempt, as amazon guided the Certificate Chain part is optional. I went on leaving it's blank. It's worked fine in the PC browsers. And the problem was arrised while trying to open it in the android mobile browsers.

I have found solution here:Setting up SSL on an Amazon Elastic Load Balancer and Creating a .pem File for SSL Certificate Installations links.

So, to avoid this I have included the chained certificate in this order:

             COMODORSADomainValidationSecureServerCA 
             COMODORSAAddTrustCA    
             AddTrustExternalCARoot

I have copy pasted the above three certificate including Begin and End tags in to the chain certificate bracket.

Now it's done. Great its worked fine. Now my SSL configuration is shown 100% secure when I checked it with Wormly Test SSL Web Server.

Thank you.

  • Welcome emre nevayeshirazi – Nagarjuna D N Mar 18 '15 at 6:10
  • 3
    Thanks, this should be the accepted answer. On a mac type cat COMODORSADomainValidationSecureServerCA.crt COMODORSAAddTrustCA.crt AddTrustExternalCARoot.crt | pbcopy to copy the files and paste that into the Certificate Chain textarea. – georgephillips Jul 17 '15 at 6:57
  • 1
    Do not include the AddTrustExternalCARoot. It is unnecessary and will bloat your cert size. – georgephillips Jul 28 '15 at 3:15
  • 1
    That worked ! I am using comodo as well and the order is accepted by AWS ELB configuration. – FacePalm Aug 6 '15 at 13:11
  • I don't get it. Does this mean that a cert chain is a text file that I modify by pasting the contents from the other crt files? – Kim Stacks Oct 27 '15 at 4:34

just use the

  1. OV_NetworkSolutionsOVServerCA2
  2. OV_USERTrustRSACertificationAuthority

Files

The AddTrustExternalCARoot File is not needed

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.