Tag Info

New answers tagged


There is X.509, and there is SSL/TLS. TLS expects the server to send an X.509 certificate chain, from which the client will extract the server's public key. Then things diverge: In pure X.509, the server should send its certificate for the client to validate; possibly, the server may add an unordered bunch of extra certificates that could prove useful to ...


The provided chain should not include the root, if it does the client must disregard it. A key feature of X.509 trust is that it requires pre-known roots (or trust anchors). This isn't the cause of your problem though. The order is inverted, the server cert should be first, followed by its signer (and its signer etc. if need be), this might cause problems on ...

Top 50 recent answers are included