1

I have a certificate signed by https://www.noip.com which I'm using in my website (https://angola.sytes.net), but the certificate is only recognized by some browsers in some places.

If you take a look at my website you'll see that the certificate was issued by TrustCor DV SSL CA - G2.

Is that related to the certificate signer?

4
  • 2
    It's not the CA, it's the chain certs. Although you can use another CA if you like, TrustCor is widely trusted. Your problem is that validating any public SSL/TLS cert needs at least one chain cert (in this case two) which the server is required to send, but your server doesn't. Some clients, especially browsers, can find the chain cert(s) on their own, but they aren't required to, and those that don't reject your cert. See whatsmychaincert.com/?angola.sytes.net . If you switch to LE but don't use its chain cert(s) you'll have the same problem. Commented Jun 28, 2022 at 1:06
  • It’s getting clear. I’ll take a look at the link and also on how to add the whole chain. Thanks a lot for the clarification.
    – Maf
    Commented Jun 28, 2022 at 6:44
  • 1
    You can do these check yourself to determine the issue. ssllabs.com/ssltest/analyze.html?d=angola.sytes.net
    – jwilleke
    Commented Jun 28, 2022 at 8:58
  • Thank you all for your insights. by replacing the certificate file for a file containing all the certificate chain, the issue was solved. You can see now that my website certificate is recognized by any browser.
    – Maf
    Commented Jun 28, 2022 at 10:36

1 Answer 1

1

I got the solution from Dave Thompson's answer, thanks a lot for that!

I just had to go to www.whatsmychaincert.com/?angola.sytes.net, there I saw that my certificate chain was wrong. Actually I did not add the certificate chain.

The solution was to replace the certificate file by a file containing the whole chain - something like:

-----BEGIN CERTIFICATE-----
MIIHnTCCBoWgAwIBAgINALvtKN6lcmz0a5LenTANBgkqhkiG9w0BAQsFADBbMQsw...
-----END CERTIFICATE-----

-----BEGIN CERTIFICATE-----
MIIEtjCCA56gAwIBAgIUIkYvfVtKEOOpNHBTTXF6pfTWoj8wDQYJKoZIhvcNAQEL...
-----END CERTIFICATE-----

-----BEGIN CERTIFICATE-----
GgAwIBAgIUKovf56gGbRis1wiRs49luaW2zVkwDQYJKoZIhvcNAQEL...
-----END CERTIFICATE-----

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .