4

The SSL certificate chain for one of my websites is incomplete, and I learned that I should reference the intermediate certificate in the virtual hosts file.

Comodo sent me two intermediate certificates with the main PositiveSSL one, COMODORSAAddTrustCA.crt and COMODORSADomainValidationSecureServerCA.crt. They are both in the format

-----BEGIN CERTIFICATE-----
somegibberish
somegibberish
somegibberish
somegibberish
-----END CERTIFICATE-----

So they looked ready to reference. When I bought the SSL for my website back in December I uploaded both of these intermediates as well as the main PositiveSSL certificate to the same folder. I added the lines SSLCertificateChainFile... below.

<VirtualHost *:443>
...
SSLEngine on
SSLCertificateFile /etc/apache2/ssl/domain.com/domain.com.crt
SSLCertificateKeyFile /etc/apache2/ssl/domain.com/domain.com.key
SSLCertificateChainFile /etc/apache2/ssl/domain.com/COMODORSAAddTrustCA.crt
SSLCertificateChainFile /etc/apache2/ssl/domain.com/COMODORSADomainValidationSecureServerCA.crt

I then ran service apache2 reload in the command shell afterwards with no issues.

Did I do this right?

Update: I looked at this page, which says that SSLCertificateChainFile is deprecated, and that I should put all the certificates all the main certificate file in a certain order. I tried that, reloaded apache2, and there are still no apparent issues so far.

5

I found the correct configuration:

<VirtualHost *:443>
...
SSLEngine on
SSLCertificateFile /etc/apache2/ssl/domain.com/domain.com.crt
SSLCertificateKeyFile /etc/apache2/ssl/domain.com/domain.com.key
SSLCertificateChainFile /etc/apache2/ssl/domain.com/COMODORSADomainValidationSecureServerCA.crt

In COMODORSADomainValidationSecureServerCA.crt I copied and pasted the contents of COMODORSAAddTrustCA.crt at the bottom.

After reloading Apache and running the site through an SSL checker the chain was reported as being valid.

  • 3
    Yeah I clicked it earlier but it said I needed to wait two days. – jonbaldie Jan 13 '15 at 13:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.