1

Say an X.509 cert is signed by an intermediate cert that's not in your browser. Maybe the root certificate is but not the intermediate cert. At that point it seems like a valid certification path could exist even if your browser doesn't know about it and I guess you'd just be S.O.L?

Seems like maybe there ought to be an extension saying where the issuer cert can be obtained (assuming it's not the root cert) just as how there exist extensions for certificate revocation lists saying where those can be obtained.

Improve this question
7

It is the server's responsibility to serve up the entire certification chain. If your web server isn't doing that, it is misconfigured, and you should fix it.

You can use the SSL test service from SSL Labs to test whether your server has SSL properly configured. Just type in your server's domain name, and it will give you a report indicating whether it has any configuration issues. You can also use GlobeSSL's SSL tester, if you want a second opinion, though I think SSL Labs' service is more comprehensive.

Improve this answer
5
  • So say I'm viewing a website's certification path / certificate hierarchy in Google Chrome or Firefox. How do I know if the intermediate certs are coming from the website or from the browser? – compcert Mar 19 '12 at 7:56
  • 1
    @compcert why does that matter? The way the PKI works, it doesnt matter where in the chain the cert is trusted, as long as there is some point where you can trust a root cert. – AviD♦ Mar 19 '12 at 8:03
  • I want to test out SSL handshaking on a server that sends multiple X.509 certs instead of just one. I'm going through the X.509 RFC's right now and fully intend to read the SSL/TLS RFC's but in lieu of that I'd still like to be able to test stuff out.. – compcert Mar 19 '12 at 13:57
  • @compcert, if you are interested in viewing this for debugging purposes, have you considered trying Wireshark? I think it has built-in support for decoding the SSL protocol, but you could take a look and see for sure. – D.W. Mar 19 '12 at 17:46
  • I have, but Wireshark isn't quite as convenient. At the moment I'm not too interested in SSL handshaking involving just a single X.509 cert. It'd be nice to be able to go "oh, is this website sending multiple certs?" whenever I think of it. Wireshark just isn't as convenient. – compcert Mar 19 '12 at 19:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.