Have I referenced my website's SSL certificate chain correctly?

Question

The SSL certificate chain for one of my websites is incomplete, and I learned that I should reference the intermediate certificate in the virtual hosts file.

Comodo sent me two intermediate certificates with the main PositiveSSL one, COMODORSAAddTrustCA.crt and COMODORSADomainValidationSecureServerCA.crt. They are both in the format

-----BEGIN CERTIFICATE-----
somegibberish
somegibberish
somegibberish
somegibberish
-----END CERTIFICATE-----

So they looked ready to reference. When I bought the SSL for my website back in December I uploaded both of these intermediates as well as the main PositiveSSL certificate to the same folder. I added the lines SSLCertificateChainFile... below.

<VirtualHost *:443>
...
SSLEngine on
SSLCertificateFile /etc/apache2/ssl/domain.com/domain.com.crt
SSLCertificateKeyFile /etc/apache2/ssl/domain.com/domain.com.key
SSLCertificateChainFile /etc/apache2/ssl/domain.com/COMODORSAAddTrustCA.crt
SSLCertificateChainFile /etc/apache2/ssl/domain.com/COMODORSADomainValidationSecureServerCA.crt

I then ran service apache2 reload in the command shell afterwards with no issues.

Did I do this right?

Update: I looked at this page, which says that SSLCertificateChainFile is deprecated, and that I should put all the certificates all the main certificate file in a certain order. I tried that, reloaded apache2, and there are still no apparent issues so far.

Answer 1

I found the correct configuration:

<VirtualHost *:443>
...
SSLEngine on
SSLCertificateFile /etc/apache2/ssl/domain.com/domain.com.crt
SSLCertificateKeyFile /etc/apache2/ssl/domain.com/domain.com.key
SSLCertificateChainFile /etc/apache2/ssl/domain.com/COMODORSADomainValidationSecureServerCA.crt

In COMODORSADomainValidationSecureServerCA.crt I copied and pasted the contents of COMODORSAAddTrustCA.crt at the bottom.

After reloading Apache and running the site through an SSL checker the chain was reported as being valid.