10 ms·

If I may take this opportunity... Does anybody know what I'm supposed to put in /etc/ssl/server.crt for SSL encryption? I have concatenated all six possible per

If I may take this opportunity... Does anybody know what I'm supposed to put in /etc/ssl/server.crt for SSL encryption? I have concatenated all six possible permutations of my own certificate ssl.crt, the intermediate certificate sub.class1.server.ca.pem and the root certificate ca.pem, but this gives me the error The certificate is not trusted because no issuer chain was provided. (Error code: sec_error_unknown_issuer) (my Ubuntu Chrome gives me a green lock, though). Feel free to visit my blank site https://ezequiel-garzon.net https://ezequiel-garzon.net Thanks!

icebraining 12y ago
Works fine here. Where are you getting an error? Maybe that client doesn't have StartCom's root cert in its trust store.
- ezequiel-garzon 12y ago
  Thanks for your reply. Ubuntu Firefox, Android Chrome... scary warnings pretty much everywhere. It'd be surprising if all these clients didn't have StartCom's root certificate. If you don't mind, how did you set up your /etc/ssl/server.crt file?
  - phaer 12y ago
    Are you sure they have the same root certificate? About a month ago, I ran in some problems because I got a new certificate from RapidSSL which had been signed by their new-ish SHA256 certificate but older clients (~3 years old browsers) had only RapidSSLs old root certificate installed.
    - ezequiel-garzon 12y ago
      Thanks for answering. I'm not sure, but wouldn't this be a widespread issue, given the popularity (read free as in beer) of StartCom certificates? I'm pretty sure I'm doing something wrong.
      - phaer 12y ago
        If you are using Firefox: click on the padlock icon -> "more information" -> "view certificate" and then on the "details" tab. If you check "certificate signature algorithm" for each of the 3 certificates, you'll see that the root certificate as well as your own one are using SHA256 but that the intermediate certificate is using SHA1. You need to bundle the right intermediate certificate which you can find, together with additional information, on https://shaaaaaaaaaaaaa.com/ https://shaaaaaaaaaaaaa.com/
        ezequiel-garzon 12y ago
        Thanks a lot! I will look into tha. As far as I can tell StartCom didn't give me a choice in that regar. Thanks for pointing me to that site. (I'd say it beats Slashdot in difficulty when you have to pass it on verbally!)
    - deleted 12y ago
      [deleted]
cesarb 12y ago
In cases like this, turn to Qualys' SSL tester: https://www.ssllabs.com/ssltest/analyze.html?d=ezequiel-garzon.net https://www.ssllabs.com/ssltest/analyze.html?d=ezequiel-garz... It shows your server as sending only one certificate, the one with "CN=ns.ezequiel-garzon.net". It's missing the next one in the chain, "CN=StartCom Class 1 Primary Intermediate Server CA". I don't know the configuration details for the server you're using, but many servers use a separate "chain" file for the intermediates; if that's the case, you should put the main certificate in one file and the "StartCom Class 1 Primary Intermediate Server CA" in the other file. And why it works in some browsers? Notice that Qualys listed the intermediate as "Extra download"; some browsers can download the intermediate certificate directly from the CA's web server. Some browsers cache the intermediate certificates they've seen, so if you've visited a properly-configured server with the same intermediate before, the browser will use the copy from its cache. But it's not recommended to depend on this; you should always include all intermediates.
- ezequiel-garzon 12y ago
  Thanks for pointing to this useful resource. It's clear now that the question is how to make httpd send all three things. I'll bring this up in the mailing lists. Thanks again!
  - Tiksi 12y ago
    You can probably do it with a bundle, the same way it's done for nginx; append the CA cert to yours: cat your_cert.crt CA_cert.crt >> cert_bundle.crt
emidln 12y ago
According to man 5 httpd.conf[1] (via man 8 httpd), it's a PEM-encoded private key. The TLS section has further configuration options. [1] - http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man5/httpd.conf.5 http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man5/...

icebraining 12y ago

Works fine here. Where are you getting an error? Maybe that client doesn't have StartCom's root cert in its trust store.

ezequiel-garzon 12y ago
Thanks for your reply. Ubuntu Firefox, Android Chrome... scary warnings pretty much everywhere. It'd be surprising if all these clients didn't have StartCom's root certificate. If you don't mind, how did you set up your /etc/ssl/server.crt file?
- phaer 12y ago
  Are you sure they have the same root certificate? About a month ago, I ran in some problems because I got a new certificate from RapidSSL which had been signed by their new-ish SHA256 certificate but older clients (~3 years old browsers) had only RapidSSLs old root certificate installed.
  - ezequiel-garzon 12y ago
    Thanks for answering. I'm not sure, but wouldn't this be a widespread issue, given the popularity (read free as in beer) of StartCom certificates? I'm pretty sure I'm doing something wrong.
    - phaer 12y ago
      If you are using Firefox: click on the padlock icon -> "more information" -> "view certificate" and then on the "details" tab. If you check "certificate signature algorithm" for each of the 3 certificates, you'll see that the root certificate as well as your own one are using SHA256 but that the intermediate certificate is using SHA1. You need to bundle the right intermediate certificate which you can find, together with additional information, on https://shaaaaaaaaaaaaa.com/ https://shaaaaaaaaaaaaa.com/
      - ezequiel-garzon 12y ago
        Thanks a lot! I will look into tha. As far as I can tell StartCom didn't give me a choice in that regar. Thanks for pointing me to that site. (I'd say it beats Slashdot in difficulty when you have to pass it on verbally!)
  - deleted 12y ago
    [deleted]

cesarb 12y ago

In cases like this, turn to Qualys' SSL tester: https://www.ssllabs.com/ssltest/analyze.html?d=ezequiel-garzon.net https://www.ssllabs.com/ssltest/analyze.html?d=ezequiel-garz... It shows your server as sending only one certificate, the one with "CN=ns.ezequiel-garzon.net". It's missing the next one in the chain, "CN=StartCom Class 1 Primary Intermediate Server CA". I don't know the configuration details for the server you're using, but many servers use a separate "chain" file for the intermediates; if that's the case, you should put the main certificate in one file and the "StartCom Class 1 Primary Intermediate Server CA" in the other file. And why it works in some browsers? Notice that Qualys listed the intermediate as "Extra download"; some browsers can download the intermediate certificate directly from the CA's web server. Some browsers cache the intermediate certificates they've seen, so if you've visited a properly-configured server with the same intermediate before, the browser will use the copy from its cache. But it's not recommended to depend on this; you should always include all intermediates.

ezequiel-garzon 12y ago
Thanks for pointing to this useful resource. It's clear now that the question is how to make httpd send all three things. I'll bring this up in the mailing lists. Thanks again!
- Tiksi 12y ago
  You can probably do it with a bundle, the same way it's done for nginx; append the CA cert to yours: cat your_cert.crt CA_cert.crt >> cert_bundle.crt

emidln 12y ago

According to man 5 httpd.conf[1] (via man 8 httpd), it's a PEM-encoded private key. The TLS section has further configuration options. [1] - http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man5/httpd.conf.5 http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man5/...