cat cert-start.pem cert-bundle.pem > chain.pem
in case it would contain also the key (in some cases it is needed but depends on usage) ot would be
cat cert-start.pem cert-bundle.pem key-no-pw.pem > full_chain.pem
In case you would check the output you will see something like this (in case of chain.pem):
... <base64 ...
I found the problem. The CSR generated by FreeIPA includes the "X509v3 Authority Key Identifier" extension set to the key ID of the FreeIPA private key. This causes certutil to believe the CA is self-signed and does not follow the certificate chain.
When signing a CSR from FreeIPA, do not copy the X509v3 Authority Key Identifier extension. Then the ...
The question is not totally correct. It is not SSL certificate may be intercepted. The SSL certificate of a website is a publicly available entity.
The SSL connection may be intercepted, especially when your client's certificate has different hash from your own, as you confirmed in your case.
Such interception is common in the large corporate IT ...
The answer is to use OpenSSL 1.1.1. I was thrown off by searches which gave old advice saying not to use 1.1.1.
The Apache change log is a good place to find out what version is supported:
This is best solution I have found around ...other solutions provided all over the internet, will not survive system reboot ;)
OS: Ubuntu 16.04
sudo vim /etc/ld.so.conf.d/libc.conf
Comment lib directory settings and add good path
# libc default configuration
When you are done editing, run this command:
This could be caused by wrong order of site, issuing, intermediate and root certificates in site's public key certificate file.
The browser display certs in reverse top-bottom direction (root, intermediate, issuing, site) but the certificate must be in bottom-top direction (site, issuing, intermediate, root).