4

In Qualys SSL test always warn me that the root certificate is an extra download and can be safely removed.

However, from Comodo website, their guide on installing cert on nginx is

NGINX Needed for this task: * PEM encoded certificates (Root, Intermediate(s) and 
Domain/Device) COMBINE (CONCATENATE) MULTIPLE CERTIFICATES INTO ONE FILE 

You know, they are a CA and be the authentic answser. So, which one I should trust?

Updates: I also gather more advises from other CA as well

Suggest adding the root cert

Suggest no need the root cert

So so confusing?

13

Both, Qualys SSL test and Comodo are correct. Comodo is correct from the server-side code perspective. Nginx should trust certificates it uses.

On the other hand, Qualys SSL test is correct from network protocol perspective. During SSL negotiation, server must send its own SSL certificate and all intermediate CA certificates except root certificate. A reference from RFC 5246 §7.4.2:

certificate_list This is a sequence (chain) of certificates. The sender's certificate MUST come first in the list. Each following certificate MUST directly certify the one preceding it. Because certificate validation requires that root keys be distributed independently, the self-signed certificate that specifies the root certificate authority MAY be omitted from the chain, under the assumption that the remote end must already possess it in order to validate it in any case.

  • I've tried to remove the root cert from the chained cert and able to get A grade from Qualys SSL. So, what is the drawbacks? If there is no drawback then why nginx need to know the root certificate? – Ryan Jan 18 '15 at 18:11
  • 1
    I'm not familiar with Nginx, but it depends on whether Nginx is able to use system trust to determine certificate trust status or not. If it is able, then you don't need to additionally install root certificate to chain file. Otherwise, you need. – Crypt32 Jan 18 '15 at 18:36
  • Thanks. For now I go without adding the root cert, but I've also updated my question for later comers since I added more contradict advises. – Ryan Jan 19 '15 at 5:17
  • It appears that Nginx is able to use system trust store to locate root certificate, as the result, you don't need to put root certificate in application. This will make you compliant with RFC. – Crypt32 Jan 19 '15 at 6:49
  • 3
    I think a web server doesn't need to establish trust with the certificate you provide it. After all, a self-signed certificate is also accepted. – r_3 Jan 24 '15 at 19:02
2

The point of certificate chain validation is that you have locally trusted (root) certificates and from that you defer trust to certificates send by the peer. So the server should only send the leaf certificate and the intermediate certificates needed to built the trust chain from a local root certificate to the leaf certificate. Which means that you should not send the root certificate but if you don't it gets usually ignored.

And you should make sure that you add the certificates in the correct order, that is first the leaf certificate and then the chain certificates in the correct signing order. Some servers or clients might work around a wrong order but you should not count on it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.