7

I issued my server a Startcom class 1 cert. With no changes on the client, I can access this server via FF without issue. However, when try to validate the certificate via openssl s_client it chokes complaining about missing certificates.

I can resolve the above openssl issue by copying Startcom's "intermediate" certificate into /etc/ssl/certs and symlinking the file in the <hash>.<iterator> format.

Question: Do I need to take this step? It appears the Startcom's root certificate is already trusted. Further FF is able to complete the certificate chain without issue. Am I missing a step? Why would the ca-certificates package trust the root and not the intermediate certificate? Why do I have to manually trust Startcom?

EDIT: I'm using ubuntu 12.04 in this case.

19

Short version:

Firefox is using its own CA database which includes the necessary Startcom intermediate certificate; OpenSSL uses /etc/ssl instead which does not have that intermediate certificate. But you should fix this at the server side, not the client side.

Long version:

SSL certificate validation requires each certificate in the chain be validated. The chain starts at the root, ends at the node certificate, and may include zero or more intermediate certificates.

The client software must have a list of trusted roots. A root is signed by itself, and is trusted by virtue of the software vendor including that certificate in its trusted roots store. In the case of Firefox, that's (I believe) cert8.db. In the case of OpenSSL, it uses the /etc/ssl hierarchy.

The client software may include intermediate certs in its store, as well. However, it's not required to. It appears that Firefox has done so for Startcom, but that Ubuntu's /etc/ssl configuration tree does not.

For this reason, it is best practices for servers using node certificates signed with an intermediate cert to include all intermediate certs when sending their certificate to any client that connects.

To directly answer your question, putting the intermediate into /etc/ssl will fix the problem - for you. Not for anyone else browsing your site. In order to properly fix it, you should add the intermediate certificate to the chain that the server hands out. For example, with Apache, see the SSLCertificateChainFile directive - DigiCert has a good walkthrough, and StartCom also has instructions.


@DanFromGermany asks, in the comments, if I can give a reference for:

best practices for servers using node certificates signed with an intermediate cert to include all intermediate certs

In fact, to call that "best practices" is not strictly true - it's a requirement. According to RFC 5246 (TLS 1.2):

[The certificate_list] is a sequence (chain) of certificates. The sender's certificate MUST come first in the list. Each following certificate MUST directly certify the one preceding it. Because certificate validation requires that root keys be distributed independently, the self-signed certificate that specifies the root certificate authority MAY be omitted from the chain, under the assumption that the remote end must already possess it in order to validate it in any case.

By inference - each certificate in the chain must directly certify the one preceding it, and only the root certificate authority is optional ("MAY be omitted"), then all intermediate certs are required.

So it's not strictly true to say that including all intermediates is best practices - it would be fairer to say that not including all intermediates is worst practices, but happens, because people are lazy, and because it works out enough of the time.

  • Awesome! I wasn't including the chain_file in my nginx config. I didn't even know I could do that. – Dane O'Connor May 8 '14 at 15:26
  • Why does FF include the intermediate certificates? – Steve Sether Feb 25 '16 at 18:14
  • "For this reason, it is best practices for servers ... to include all intermediate certs" - Please, do you have a source that confirms that this is best practice? – Daniel W. Jul 1 '16 at 9:12
  • 2
    @DanFromGermany, I've updated the answer to address your comment. – gowenfawr Jul 1 '16 at 12:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.