0

I am trying to install a chain certificate from Entrust on a red hat server 7.5 that uses apache 2.4.6. Following some articles I found, I did the following: Edited /etc/httpd/conf.d/ssl.conf file in order to include

Server Certificate SSLCertificateFile /path/to/file

Server Private Key SSLCertificateKeyFile /path/to/file

Certificate Authority(CA) SSLCACertificateFile /path/to/file

Although site works with https and browser understands the certificate as valid, How can I know if the certificate installed successfully? Browser indicates that part of the site is not trusted because of images. Should I do something else with .cer and .pem files from Entrust? How can I understand if the chain certificate is installed as intended?

  • A certificate from a CA would not be self signed. Did you edit the correct vhost? Did you restart/reload apache after making the changes? – Gerald Schneider Oct 11 '18 at 13:23
  • @GeraldSchneider you are right I edited the original post because I was looking at another IP – GeralexGR Oct 11 '18 at 13:25
  • 3
    Browser indicates that part of the site is not trusted because of images. Open an image directly and see what's the matter. Either it's loaded from a different server with an invalid certificate or they are loaded over http. – Gerald Schneider Oct 11 '18 at 13:26
  • @GeraldSchneider yes indeed some images are loaded from a different server via http. Is there a way to validate that the chain certificate is installed correctly? – GeralexGR Oct 11 '18 at 13:31
2

There are two ways to verify the certificates.

  1. Go to SSL Labs and run their SSL Server Test. Wait a bit and check the results.
  2. Use openssl command line as follows.

Replace HOSTNAME with your actual host name. This assumes you have a valid root certificate chain configured into openssl as well.

openssl s_client -connect HOSTNAME:443

Then look for the chain in the output, something like this:

Certificate chain
 0 s:/CN=HOSTNAME
   i:/C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3
 1 s:/C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3
   i:/O=Digital Signature Trust Co./CN=DST Root CA X3

and at the very bottom:

Verify return code: 0 (ok)
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.