Iʼm trying to create my own certificate authority using the XCA software. I have successfully created the root CA (Fisir Technologies CA) and intermediate CA (Fisir Technologies Intermediate CA X1). However, I want to have one more intermediate CA (Fisir Technologies Endpoint CA WWW) under the first intermediate CA (Fisir Technologies Intermediate CA X1). The second intermediate CA is supposed to issue the end entity certificates.

Iʼve done all this and imported my root CA as a trusted root certificate authority (on Windows). Then, I created a new HTTPS certificate signed by the second intermediate CA. I tried to open it with the default certificate viewer on Windows, but it told me that it doesnʼt have enough information to validate the certificate. That was what I expected, as I had installed only the root CA.

So I created a certificate chain, including the root CA, the two intermediate CAs and the HTTPS certificate. I uploaded it onto my VPS, set up the HTTPS server in nginx and tried accessing it. But Google Chrome welcomed me with a NET::ERR_CERT_INVALID error.

I clicked on the crossed red lock in the address bar and it said that the certificate is not valid. So I chose to view the certificate and it opened it again in the Windows default certificate viewer. But it did not show any error. I looked at the certificate path and it was shown correctly:

Certificate path

It also said that the certificate is valid. Also, every online HTTPS checker that I could found did not show any issue with the setup (except for untrusted root CA, of course).

I tried to modify various properties of the certificate, but it would never work. Then I tried to issue the exact same certificate as the first time, but this time I signed it with the first intermediate CA. I refreshed the page and it worked.

But I want to issue the certificates using the second intermediate CA. Anyone knows what the problem might be?

You can check the problem for yourself live at https://php.technologies.fisir.net.

Thank you.


You have a few issues here:

  1. Your Root CA Certificate has a pathlen in its basicConstraints - not needed and not used, but it shouldn't cause problems.
  2. You have a certificate policy on your Root CA Certificate - this would be better applied by your Root CA to the subordinate CAs. If you wanted to change policy at a latter date, or add another policy, you'd have to resign and re-issue your Root CA Certificate to all relying parties. Again, it shouldn't cause your reported issue though.


  1. Your Root CA CRL in your CRL Distribution Point at http://crl.ca.technologies.fisir.net/root.crl is inaccessible. Your relying parties cannot chain-build as the cannot check for revocation. This assumes that they check.
  2. Your first subordinate CA's CRL is also inaccessible at http://crl.ca.technologies.fisir.net/intermediate-x1.crl - same as above.
  3. Your issuing CA's CRL is also inaccessible at http://crl.ca.technologies.fisir.net/x1-endpoint-www.crl - there's a pattern forming here ;-)
  4. The OCSP server in the Authority Information Access extension is inaccessible (it won't even resolve to an IP address). A relying party that uses OCSP to check for revocation will fail.

I'd guess that your issues are down to the relying parties (Chrome etc) being unable to check revocation, and therefore are unable to successfully build a certificate chain.

  • 1
    Thank you very much! I changed the root CA according to your suggestions and (thanks to you) realized that I have set the CRL Distribution Points wrong. I set the root.crl for the root CA, not for the first intermediate CA and so on. I fixed this, removed the OCSP entry and it is now working fine. Once again, thank you! – Jakub Apr 7 '16 at 18:15
  • Ah yes - I failed to spot that one :-) – garethTheRed Apr 7 '16 at 19:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.