I attempted to upgrade my one Web site, running
nginx, from a SHA-1 SSL123 certificate to a SHA-2 one.
Thawte's Web page with intermediate CAs has "RSA SHA-2 (under SHA-1 Root)" and "RSA SHA-2 (under SHA-2 Root)" tables.
If I use the CA bundle for "under SHA-1 Root", I see that the bundle contains two certificates, and my Web site works. However, Qualys' SSL Test rightfully dings me for having a SHA-2 certificate with SHA-1 in the certificate chain.
However, the "under SHA-2 Root" table does not have bundles. If I use the single intermediate certificate they supply there, Firefox and other tools point out that the certificate chain is broken, and browsers won't load my site.
Right now, I'm using the SHA-1 root, to have a working site. However, I would like to switch to the SHA-2 root.
Where do I get the missing intermediate certificate? Or, if that's not the problem, how do I create a combined certificate file for Thawte's SSL123 fro a SHA-2 certificate with a full chain of SHA-2 intermediate certificates?