0

The SSL tester at sslcheck.globalsign.com says:

Server configuration does not include all intermediate certificates

I found this page: http://yob.id.au/2013/02/06/trusting-new-ssl-certificates-in-debian.html and they say I should do the following: 1.Open the affected domain in a browser and view the intermediate certificate 2.Export the certificate to a file with a .crt extension 3.Copy the file to your Debian box and place it in /usr/local/share/ca-certificates 4.As root, run update-ca-certificates

It said:

Updating certificates in /etc/ssl/certs... 1 added, 0 removed; done. Running hooks in /etc/ca-certificates/update.d....done.

I did it, but it still isn't working. What should I do?

By the way, sometimes I can read (just like in the example above) that I should put certificates into /usr/local/share/ca-certificates, other times that I should put them to /etc/ssl/certs, so what is the correct location?

Improve this question
4
  • The issue is not that your server needs to trust this CA, but rather, that your webserver needs to be sending the either certificate chain to your clients.
    – EEAA
    Commented Jan 12, 2015 at 16:38
  • OK, but how to accomplish this?
    – Konrad
    Commented Jan 12, 2015 at 16:43
  • What is your webserver? Apache? nginx? IIS?
    – NuTTyX
    Commented Jan 12, 2015 at 16:49
  • Apache on Debian.
    – Konrad
    Commented Jan 12, 2015 at 16:52

1 Answer 1

Reset to default
4

Inside your apache's config files, search for this directive: SSLCertificateChainFile (if apache version 2.4.7 or lower) or SSLCertificateFile (if apache version 2.4.8 or higher)

The file pointed in that directive must contain the server certificate, followed by the issuer CA (and the issuer's issuer CA, and so on). It should look like this:

-----BEGIN CERTIFICATE-----
qUCAwEAAaOCAWUwggFhqUCAwEAAaOCAWUwggFhqUC
qUCAwEAAaOCAWUwggFhqUCAwEAAaOCAWUwggFhqUC
qUCAwEAAaOCAWUwggFhqUCAwEAAaOCAWUwggFhqUC
qUCAwEAAaOCAWUwggFhqUCAwEAAaOCAWUwggFhqUC
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
qUCAwEAAaOCAWUwggFhqUCAwEAAaOCAWUwggFhqUC
qUCAwEAAaOCAWUwggFhqUCAwEAAaOCAWUwggFhqUC
qUCAwEAAaOCAWUwggFhqUCAwEAAaOCAWUwggFhqUC
qUCAwEAAaOCAWUwggFhqUCAwEAAaOCAWUwggFhqUC
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
qUCAwEAAaOCAWUwggFhqUCAwEAAaOCAWUwggFhqUC
qUCAwEAAaOCAWUwggFhqUCAwEAAaOCAWUwggFhqUC
qUCAwEAAaOCAWUwggFhqUCAwEAAaOCAWUwggFhqUC
qUCAwEAAaOCAWUwggFhqUCAwEAAaOCAWUwggFhqUC
-----END CERTIFICATE-----

Being the first certificate the server's, the second the intermediate CA's, etc.

Improve this answer
2
  • I did it, and it didn't work:( Please note, that before that, I added SSL through DirectAdmin, maybe there is a mess right now? Additionally, in httpd-ssl.conf there is a line like this: SSLCACertificateFile /etc/httpd/conf/ssl.crt/server.ca with 6 'BEGIN CERTIFICATE' lines, and I don't know where they came from.
    – Konrad
    Commented Jan 13, 2015 at 9:13
  • OK, nevermind, I did this through Direct Admin.
    – Konrad
    Commented Jan 13, 2015 at 10:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .