0

According to https://www.digicert.com/help/, my certificate for https://sqless.ddns.net (my Apache XAMPP REST web service) isn't trusted because

SSL Certificate is not trusted

The certificate is not signed by a trusted authority (checking against Mozilla's root store). If you bought the certificate from a trusted authority, you probably just need to install one or more Intermediate certificates. Contact your certificate provider for assistance doing this for your server platform.

This is strange because both Google and Firefox display the green padlock as well as a "Secure" on Chrome.

I used this tutorial in order to set up SSL on my server. These are my Virtual Hosts in C:\xampp\apache\conf\extra\httpd-vhosts.conf.

<VirtualHost *:80>
    ServerAdmin myemail@email.com
    ServerName sqless.ddns.net

    RewriteEngine On
    # Redirect to the HTTPS site
    RewriteCond %{HTTPS} off
    RewriteRule ^/?(.*)$ https://sqless.ddns.net/$1 [NE,L,R=301]
</VirtualHost>

<VirtualHost *:443>
    ServerAdmin myemail@email.com
    ServerName sqless.ddns.net

    RewriteEngine On
    # Redirect to the correct domain name
    RewriteCond %{HTTP_HOST} !^sqless.ddns.net$ [NC]
    RewriteRule ^/?(.*)$ https://sqless.ddns.net/$1 [NE,L,R=301]

    Alias /.well-known C:/xampp/htdocs/.well-known

    SSLEngine on
    SSLCertificateFile "C:/Users/Morgan/AppData/Roaming/letsencrypt-win-simple/httpsacme-v01.api.letsencrypt.org/sqless.ddns.net-crt.pem"
    SSLCertificateKeyFile "C:/Users/Morgan/AppData/Roaming/letsencrypt-win-simple/httpsacme-v01.api.letsencrypt.org/sqless.ddns.net-key.pem"
    SSLCertificateChainFile "C:/Users/Morgan/AppData/Roaming/letsencrypt-win-simple/httpsacme-v01.api.letsencrypt.org/sqless.ddns.net-crt.pem"
</VirtualHost>

I used version 1.8.0 of Win-Acme located here: https://github.com/PKISharp/win-acme/releases

Am I missing something?

5

See this report more detailed: https://www.ssllabs.com/ssltest/analyze.html?d=sqless.ddns.net which shows "This server's certificate chain is incomplete. Grade capped to B.".

Notably the "Extra download" part in the "Certification Paths". Your server needs to send the intermediate CA. Which means SSLCertificateChainFile can not just be the same content as the one in SSLCertificateFile.

Have a look again at the tutorial you quote, you will see it shows this difference which you did not respect. You can find the CA intermediate certificates on their page: https://letsencrypt.org/certificates/

So in your SSLCertificateChainFile you need, in order, the intermediary certificate, and then the CA one. As you can see from the SSLLabs results, your final certificate was generated by "Let's Encrypt X3" (intermediate CA) which is itself signed by "DST Root CA X3". If you go to https://letsencrypt.org/certificates/ you can find both of them.

You need to put them together in a file, just one after the other. You should arrive at this content then:

-----BEGIN CERTIFICATE-----
MIIEkjCCA3qgAwIBAgIQCgFBQgAAAVOFc2oLheynCDANBgkqhkiG9w0BAQsFADA/
MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT
DkRTVCBSb290IENBIFgzMB4XDTE2MDMxNzE2NDA0NloXDTIxMDMxNzE2NDA0Nlow
SjELMAkGA1UEBhMCVVMxFjAUBgNVBAoTDUxldCdzIEVuY3J5cHQxIzAhBgNVBAMT
GkxldCdzIEVuY3J5cHQgQXV0aG9yaXR5IFgzMIIBIjANBgkqhkiG9w0BAQEFAAOC
AQ8AMIIBCgKCAQEAnNMM8FrlLke3cl03g7NoYzDq1zUmGSXhvb418XCSL7e4S0EF
q6meNQhY7LEqxGiHC6PjdeTm86dicbp5gWAf15Gan/PQeGdxyGkOlZHP/uaZ6WA8
SMx+yk13EiSdRxta67nsHjcAHJyse6cF6s5K671B5TaYucv9bTyWaN8jKkKQDIZ0
Z8h/pZq4UmEUEz9l6YKHy9v6Dlb2honzhT+Xhq+w3Brvaw2VFn3EK6BlspkENnWA
a6xK8xuQSXgvopZPKiAlKQTGdMDQMc2PMTiVFrqoM7hD8bEfwzB/onkxEz0tNvjj
/PIzark5McWvxI0NHWQWM6r6hCm21AvA2H3DkwIDAQABo4IBfTCCAXkwEgYDVR0T
AQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAYYwfwYIKwYBBQUHAQEEczBxMDIG
CCsGAQUFBzABhiZodHRwOi8vaXNyZy50cnVzdGlkLm9jc3AuaWRlbnRydXN0LmNv
bTA7BggrBgEFBQcwAoYvaHR0cDovL2FwcHMuaWRlbnRydXN0LmNvbS9yb290cy9k
c3Ryb290Y2F4My5wN2MwHwYDVR0jBBgwFoAUxKexpHsscfrb4UuQdf/EFWCFiRAw
VAYDVR0gBE0wSzAIBgZngQwBAgEwPwYLKwYBBAGC3xMBAQEwMDAuBggrBgEFBQcC
ARYiaHR0cDovL2Nwcy5yb290LXgxLmxldHNlbmNyeXB0Lm9yZzA8BgNVHR8ENTAz
MDGgL6AthitodHRwOi8vY3JsLmlkZW50cnVzdC5jb20vRFNUUk9PVENBWDNDUkwu
Y3JsMB0GA1UdDgQWBBSoSmpjBH3duubRObemRWXv86jsoTANBgkqhkiG9w0BAQsF
AAOCAQEA3TPXEfNjWDjdGBX7CVW+dla5cEilaUcne8IkCJLxWh9KEik3JHRRHGJo
uM2VcGfl96S8TihRzZvoroed6ti6WqEBmtzw3Wodatg+VyOeph4EYpr/1wXKtx8/
wApIvJSwtmVi4MFU5aMqrSDE6ea73Mj2tcMyo5jMd6jmeWUHK8so/joWUoHOUgwu
X4Po1QYz+3dszkDqMp4fklxBwXRsW10KXzPMTZ+sOPAveyxindmjkW8lGy+QsRlG
PfZ+G6Z6h7mjem0Y+iWlkYcV4PIWL1iwBi8saCbGS5jN2p8M+X+Q7UNKEkROb3N6
KOqkqm57TH2H3eDJAkSnh6/DNFu0Qg==
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIDSjCCAjKgAwIBAgIQRK+wgNajJ7qJMDmGLvhAazANBgkqhkiG9w0BAQUFADA/
MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT
DkRTVCBSb290IENBIFgzMB4XDTAwMDkzMDIxMTIxOVoXDTIxMDkzMDE0MDExNVow
PzEkMCIGA1UEChMbRGlnaXRhbCBTaWduYXR1cmUgVHJ1c3QgQ28uMRcwFQYDVQQD
Ew5EU1QgUm9vdCBDQSBYMzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
AN+v6ZdQCINXtMxiZfaQguzH0yxrMMpb7NnDfcdAwRgUi+DoM3ZJKuM/IUmTrE4O
rz5Iy2Xu/NMhD2XSKtkyj4zl93ewEnu1lcCJo6m67XMuegwGMoOifooUMM0RoOEq
OLl5CjH9UL2AZd+3UWODyOKIYepLYYHsUmu5ouJLGiifSKOeDNoJjj4XLh7dIN9b
xiqKqy69cK3FCxolkHRyxXtqqzTWMIn/5WgTe1QLyNau7Fqckh49ZLOMxt+/yUFw
7BZy1SbsOFU5Q9D8/RhcQPGX69Wam40dutolucbY38EVAjqr2m7xPi71XAicPNaD
aeQQmxkqtilX4+U9m5/wAl0CAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAOBgNV
HQ8BAf8EBAMCAQYwHQYDVR0OBBYEFMSnsaR7LHH62+FLkHX/xBVghYkQMA0GCSqG
SIb3DQEBBQUAA4IBAQCjGiybFwBcqR7uKGY3Or+Dxz9LwwmglSBd49lZRNI+DT69
ikugdB/OEIKcdBodfpga3csTS7MgROSR6cz8faXbauX+5v3gTt23ADq1cEmv8uXr
AvHRAosZy5Q6XkjEGB5YGV8eAlrwDPGxrancWYaLbumR9YbK+rlmM6pZW87ipxZz
R8srzJmwN0jP41ZL9c8PDHIyh8bwRLtTcm1D9SZImlJnt1ir/md2cXjbDaJWFBM5
JDGFoqgCWjBH4d1QB7wCCZAA62RjYJsWvIjJEubSfZGL+T0yjWW06XyxV3bqxbYo
Ob8VZRzI9neWagqNdwvYkQsEjgfbKbYK7p2CNTUQ
-----END CERTIFICATE-----
  • This is embarrassing. This was it. You're right. Thank you!! – Morgan May 7 '18 at 16:56
  • I ran the test one more time and the website ssllabs now says This server's certificate chain is incomplete. Grade capped to B.. I installed the certificate and everything works, but the website still shows that. Digicert/help doesn't report any errors. I also used the one in @Zoredache answer but ssllabs still shows that. – Morgan May 7 '18 at 17:11
  • SSLCertificateChainFile should point to a file with 2 certificates in this order concatenated: the intermediate one (letsencrypt.org/certs/lets-encrypt-x3-cross-signed.pem.txt) and then the CA one, being "DST Root CA X3" which is on identrust.com/certificates/trustid/root-download-x3.html. Then restart your webserver and redo your tests making sure they run from scratch. The error from SSLLabs you see is the same as the previous one. See the "Certification Paths" block, click on Expand. – Patrick Mevzek May 7 '18 at 17:22
  • How do you concatenate those files in SSLCertificateChainFile? What's the syntax? – Morgan May 7 '18 at 17:32
  • @Morgan see my edited reply with more content. No special syntax, just a concatenation. – Patrick Mevzek May 7 '18 at 17:36
2

Right now you have the chain pointed to the same file as your certificate. This is not correct.

SSLCertificateFile ".../sqless.ddns.net-crt.pem"
SSLCertificateChainFile ".../sqless.ddns.net-crt.pem"

Your chain should be pointed at the intermediate certificate.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.