0

I installed my certificate but encountered incomplete chain error at ssllabs.

server {
    listen 443 ssl;

    ssl on;
    ssl_certificate     /var/www/ssl/domain.crt;
    ssl_certificate_key /var/www/ssl/domain.key;

domain.crt contains a single certificate. Then I created domain.bundle as cat domain.crt domain.med domain.root > domain.bundle and set

ssl_certificate     /var/www/ssl/domain.bundle;

Then I reboot nginx, then server, but I still have incomplete chain error.

openssl s_client -connect domain.ru:443 gives just one certificate in Certificate chain.

How can I make nginx to return the whole chain? Is it some kind of a cache?

/var/www/ssl/domain.bundle does contain three certificates.

2
  • 1
    Check domain.bundle to make sure the BEGIN and END markers are on separate lines. I had an intermediate certificate with no terminating newline, so cat did not create a suitable bundle. Also, you do not need the root in the bundle, as the client browser already knows that. Feb 7, 2017 at 11:26
  • SO helps. The file is OK, but I found that there are two server sections, and I forgot to fix the second one. Thanks for a target! Feb 7, 2017 at 11:35

0

You must log in to answer this question.

Browse other questions tagged .