The SSL certificate chain for one of my websites is incomplete, and I learned that I should reference the intermediate certificate in the virtual hosts file.
Comodo sent me two intermediate certificates with the main PositiveSSL one, COMODORSAAddTrustCA.crt and COMODORSADomainValidationSecureServerCA.crt. They are both in the format
-----BEGIN CERTIFICATE-----
somegibberish
somegibberish
somegibberish
somegibberish
-----END CERTIFICATE-----
So they looked ready to reference. When I bought the SSL for my website back in December I uploaded both of these intermediates as well as the main PositiveSSL certificate to the same folder. I added the lines SSLCertificateChainFile...
below.
<VirtualHost *:443>
...
SSLEngine on
SSLCertificateFile /etc/apache2/ssl/domain.com/domain.com.crt
SSLCertificateKeyFile /etc/apache2/ssl/domain.com/domain.com.key
SSLCertificateChainFile /etc/apache2/ssl/domain.com/COMODORSAAddTrustCA.crt
SSLCertificateChainFile /etc/apache2/ssl/domain.com/COMODORSADomainValidationSecureServerCA.crt
I then ran service apache2 reload
in the command shell afterwards with no issues.
Did I do this right?
Update: I looked at this page, which says that SSLCertificateChainFile
is deprecated, and that I should put all the certificates all the main certificate file in a certain order. I tried that, reloaded apache2, and there are still no apparent issues so far.