7

What are the actual risks associated with an incomplete certificate chain

I read about certificate chains and I think I understand the concept but I seem to not understand the potential risks, for instance SSLLabs checks and states if a certificate chain is incomplete but still rates certificates with incomplete chains very highly (A) so this implies to me that the chain doesn't seem to be that important, whereas my understanding is that the chain is a trust issue and so that should be very important.

What security loops can effect me if I do not have a complete certificate chain?

Update:

Reviewing my source this morning, I find that the certificate chain issue has been resolved; prevously it stated:

Certificates provided 2 (2936 bytes)
Chain issues Incomplete Chain

But this morning it states:

Certificates provided 3 (4716 bytes)
Chain issues None

This maybe because I told the company about this, or maybe that it's simply a fix on the cloudhosting, or some other thrd party issue.

Improve this question
4
  • I thought SLL Labs should rate them as "T"? ("T" for trust issues.) Do you have an example link?
    – StackzOfZtuff
    Jul 8, 2017 at 7:24
  • @StackzOfZtuff I reviewed the site this morning and their chain issues seem to have been resolved (disappointingly for this question).
    – Martin
    Jul 8, 2017 at 8:11
  • 1
    SSL labs caps grades to "B" for sites that are missing intermediate certificates. E.g., incomplete-chain.badssl.com -- ssllabs.com/ssltest/analyze.html?d=incomplete-chain.badssl.com
    – Anand Bhat
    Jul 8, 2017 at 21:37
  • @AnandBhat no, it was definitely A when I ran their test.
    – Martin
    Jul 8, 2017 at 22:44

1 Answer 1

Reset to default
8

Missing chain certificates are not a security problem by itself. That means just because chain certificates are missing an attacker cannot mount attacks he could not do when these certificates were present. But, missing chain certificates can indirectly cause problems which are security relevant.

Missing chain certificates often means that the peer cannot verify the certificate and thus fails to establish the HTTPS connection. While several desktop browser try to work around such problems by using cached chain certificates or downloading the certificates such behavior is usually only restricted to these browser. Most other applications will just fail to connect. In most cases failing to connect is just annoying. But in some environments this can be a serious problems if important data do not get exchanged because of this.

Also, some developers try to work around such kind of problems by disabling certificate validation. Unfortunately there are way too many answers and comments on stackoverflow.com which suggest simply disabling validation in such cases without pointing out the security problems this causes. Because, while this seems to fix the current problem in that the TLS connection works, it also makes simple man in the middle attacks possible and thus creates a huge security problem.

Improve this answer
5
  • 1
    To clarify, I've found certificates that SSLlabs says are missing intermediaries but that works perfectly adequately in my browsers. Your answer seems to assume that a missing link would cause the whole cerificate to raise issues and not connect, but this is not the behaviour I've seen. Am I right in thinking that missing chain intermediaries are [just] a trust issue?
    – Martin
    Jul 7, 2017 at 22:48
  • You should have started the answer with the fact that there is a big security implication.
    – sandyp
    Jul 8, 2017 at 0:02
  • 2
    @sandyp No, because there isn't a big security implication. Browsers will either find the missing certificates and connect, or not find the missing certificates and refuse to connect. SSLlabs focuses on public websites, not on the use of TLS in general, so the behavior with broken custom applications is out of their scope.
    – Gilles 'SO- stop being evil'
    Jul 8, 2017 at 0:29
  • @Martin What you've seen is your browser using a cached certificate, as Steffen explains in the second paragraph of his answer.
    – Gilles 'SO- stop being evil'
    Jul 8, 2017 at 0:30
  • @sandyp: I hopefully made it clearer now that missing certificates by themselves are not a security problem, but that they indirectly can cause some.
    – Steffen Ullrich
    Jul 8, 2017 at 4:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .