Hacker News new | past | comments | ask | show | jobs | submit login

In cases like this, turn to Qualys' SSL tester: https://www.ssllabs.com/ssltest/analyze.html?d=ezequiel-garz...

It shows your server as sending only one certificate, the one with "CN=ns.ezequiel-garzon.net". It's missing the next one in the chain, "CN=StartCom Class 1 Primary Intermediate Server CA". I don't know the configuration details for the server you're using, but many servers use a separate "chain" file for the intermediates; if that's the case, you should put the main certificate in one file and the "StartCom Class 1 Primary Intermediate Server CA" in the other file.

And why it works in some browsers? Notice that Qualys listed the intermediate as "Extra download"; some browsers can download the intermediate certificate directly from the CA's web server. Some browsers cache the intermediate certificates they've seen, so if you've visited a properly-configured server with the same intermediate before, the browser will use the copy from its cache. But it's not recommended to depend on this; you should always include all intermediates.




Thanks for pointing to this useful resource. It's clear now that the question is how to make httpd send all three things. I'll bring this up in the mailing lists. Thanks again!


You can probably do it with a bundle, the same way it's done for nginx; append the CA cert to yours:

    cat your_cert.crt CA_cert.crt >> cert_bundle.crt




Join us for AI Startup School this June 16-17 in San Francisco!

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: