4 ms·
I tried my site from both Debian and iOS. (“openssl s_client” 1.1.1k and the HE.net app, respectively.) Debian shows a chain ending with the ISRG X1 cert that
by gorgoiler 5y ago
I tried my site from both Debian and iOS. (“openssl s_client” 1.1.1k and the HE.net app, respectively.)
Debian shows a chain ending with the ISRG X1 cert that was signed by DST X3.
iOS shows a chain ending with the self-signed ISRG X1.
This happened even though Debian has the self-signed ISRT X1 installed as a root, and even if I delete the DST X3 from my list of roots.
I don’t really understand how this can happen.
- spockz 5y agoI noticed that some clients/parsers, like OpenSSL are sensitive to the order of the certs in the chain (according to spec) whereas others try to “reconstruct” the tree visually.