Server: Windows 2012 R2 / IIS 8.5 using SNI (Azure Virtual Machine)
I have an SSL certificate that has been installed and is working in all browsers except Firefox and iOS Safari. The chain in Chrome and IE appears as follows:
Baltimore CyberTrust Root ---->XX Public Root Certification Authority -------->XX Certification Authority ----------->xxx.domain.com
In Firefox and Safari on iOS, you get a message that says the site is untrusted and if you view the certificate via Add Exception the chain appears as follows:
XX Certification Authority ----->xxx.domain.com
XX Certification Authority has signed the xx.domain.com certificate. Public Root Certification Authority has signed the XX Certification Authority and CyberTrust has signed Public Root Certification.
The intermediate certificates are in the Intermediate Certification Authorities store on the server. For some reason, Firefox will not download the complete certificate chain (or the server is not sending it). I have tried to delete cert8.db in the Firefox profile and I've had it happen on clean machines consistently.
I have tested my domain at sslshopper.com and ssllabs.com. They do not report any errors and report that all intermediate certificates are installed correctly.