0

I have recently installed a new SSL certificate on Apache 2.x with openssl and have a user report to not be able to access the page. He does the error NET::ERR_CERT_AUTHORITY_INVALID

Although I could not reproduce the problem, a check on the SSL certificate revails some issues with a chain: https://www.ssllabs.com/ssltest/analyze.html?d=static.watchgurus.net

Is there some cert missing in my configuration?

1 Answer 1

1

It looks like the certificate is missing the IA (Intermediate Authority), or possibly the layout of the certificate is wrong.

On my Nginx I have it as:

  1. Server
  2. IA
  3. Private Key

Is this what yours looks like?

EDIT: Let me try and clear things up a bit, you would have had to generate a CSR and private key when requesting your certificate. After which your SSL provider would have sent you a bundle including the following, dependent on what format you requested the certificate to be sent.

  • CA Root Certificate
  • IA Certificate (They sometimes send 2)
  • Server Certificate

Use a text editor to open the above mentioned certificates, also create a new called static.watchgurus.net.pem.

You can now paste the Server, IA and Private Keys in this order and save the .pem. Use Keystore Explorer to open the newly created .pem, it should show the IA then have a little branch down showing static.watchgurus.net.

Like this: Google Certificate Chain

7
  • Thank you for your answer. How can I check that? Do you mean the certificate itself or the configuration of apache?
    – merlin
    Mar 26, 2019 at 14:03
  • I mean the certificate itself. You should have received a certificate bundle from your provider, this will contain the IA (maybe 2 of them) and the root. You can use a text editor to string these individual files together and create your own certificate. I personally use a .pem consisting of the above, you can use keystore-explorer.org to open the certificate you created and confirm the validity.
    – niel
    Mar 26, 2019 at 15:15
  • Edited my answer to make it a bit clearer
    – niel
    Mar 26, 2019 at 15:46
  • Thank you. Now a bit clearer, but I am still strugling. My provider gave me access to the following certs: CRT, INTERMEDIATE, ROOT (CA). It is not entirly clear to me in which order they need to go from your description and other docs. I leaned that the ROOT (CA), should not be included.
    – merlin
    Mar 26, 2019 at 19:14
  • I believe I got it working now. The provider hat two INTERMEDIATE crt in one field placed underneath of each other with a button "copy to clipboard". The order apeared to be wrong, I changed the order by hand and now it looks like it is working from what I see inside ssllabs. Can you confirm that?
    – merlin
    Mar 26, 2019 at 20:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .