Iʼm trying to create my own certificate authority using the XCA software. I have successfully created the root CA (
Fisir Technologies CA) and intermediate CA (
Fisir Technologies Intermediate CA X1). However, I want to have one more intermediate CA (
Fisir Technologies Endpoint CA WWW) under the first intermediate CA (
Fisir Technologies Intermediate CA X1). The second intermediate CA is supposed to issue the end entity certificates.
Iʼve done all this and imported my root CA as a trusted root certificate authority (on Windows). Then, I created a new HTTPS certificate signed by the second intermediate CA. I tried to open it with the default certificate viewer on Windows, but it told me that it doesnʼt have enough information to validate the certificate. That was what I expected, as I had installed only the root CA.
So I created a certificate chain, including the root CA, the two intermediate CAs and the HTTPS certificate. I uploaded it onto my VPS, set up the HTTPS server in nginx and tried accessing it. But Google Chrome welcomed me with a
I clicked on the crossed red lock in the address bar and it said that the certificate is not valid. So I chose to view the certificate and it opened it again in the Windows default certificate viewer. But it did not show any error. I looked at the certificate path and it was shown correctly:
It also said that the certificate is valid. Also, every online HTTPS checker that I could found did not show any issue with the setup (except for untrusted root CA, of course).
I tried to modify various properties of the certificate, but it would never work. Then I tried to issue the exact same certificate as the first time, but this time I signed it with the first intermediate CA. I refreshed the page and it worked.
But I want to issue the certificates using the second intermediate CA. Anyone knows what the problem might be?
You can check the problem for yourself live at https://php.technologies.fisir.net.