3 ms·
One thing to note is that the Qualys SSL Labs test will complain if your server sends the (self-signed) root CA certificate, which will already be in the end-us
by praseodym 12y ago
One thing to note is that the Qualys SSL Labs test will complain if your server sends the (self-signed) root CA certificate, which will already be in the end-user's trust store. This uses unnecessary bandwidth for every TLS negotiation.
In many cases, the CA (or company you got your certificate from) will include this root cert in the chain. With most web servers it is perfectly fine to simply remove it, but I have seen applications where you cannot (VMware, which wants a complete chain ending with a self-signed cert) and where you'll have to ignore the SSL Labs warning.
- zakjan 12y agoYes, you are right, a root cert shouldn't be sent by server. My script doesn't append it to output, because (I hope) no intermediate certificate has AIA extension pointing to the root cert. If you find a counterexample, please file an issue, I will add a check.
- iancarroll 12y agoA tangent of this is where you will get many irrelevant warnings due to compatibility chains. Comodo uses "Comodo <keytype> Certification Authority" but this has to be sent with your request as not all clients trust it, but they will trust the issuer.