5 ms·
At some point in the last ten years, most browser vendors enabled a feature that will do automatic discovery of an intermediate certificate. The most noteworth
by dvanduzer 12y ago
At some point in the last ten years, most browser vendors enabled a feature that will do automatic discovery of an intermediate certificate.
The most noteworthy exception to this is the builtin Android browser in the 2.x (and possibly later) series. As a result, failure to include the intermediate certificate on the server quite frequently goes unnoticed.
- ultramancool 12y agoThis also fails with many non-browser applications. For example, if Murmur (the server for the Mumble VOIP application) does not detect your certificate is correctly chained, your server won't even start. Best to set it up correctly in any case.
- dvanduzer 12y agoI'm not sure there's anything about the X.509 standard that can be termed "correct" but yes, serve intermediates. Many QA engineers are ambushed by this new "edge" case. This change in browser behavior has made it easier for the problem to go undetected.
- hrjet 12y agoAnother common non-browser example: `curl`
- agwa 12y agoIE does this, but Firefox doesn't and never has. See: https://bugzilla.mozilla.org/show_bug.cgi?id=399324 https://bugzilla.mozilla.org/show_bug.cgi?id=399324 https://bugzilla.mozilla.org/show_bug.cgi?id=245609 https://bugzilla.mozilla.org/show_bug.cgi?id=245609 Chain cert problems can still go unnoticed in Firefox, however, because Firefox does cache chain certificates that it encounters browsing other sites. In any case, the relevant RFCs require servers to send a complete chain.