We have a secure server that seems to only be sending over the identity certificate. Running the hostname through Qualys says that only 1 cert was provided. The intermediate had to be downloaded on the fly. This is not a problem for browsers but we have a custom app which uses an SSL library to connect to these servers that can't build alternate paths or download certs on the fly. We have double checked and the server does have the proper certificates installed. Has anyone ever ran into this?

closed as unclear what you're asking by Gilles, TildalWave, Xander, AJ Henderson, Graham Hill Oct 20 '14 at 14:12

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    And your certificate is signed by the Intermediate CA? – RoraΖ Aug 19 '14 at 12:18
  • Yes the chain is correct. All signatures, and key identifiers link together. – user53029 Aug 19 '14 at 13:37
  • 1
    Can you tell us what kind of server it is, and if you have control over its configuration? I'm willing to bet that even if the certificates are installed the server isn't properly configured to see them. – RoraΖ Aug 19 '14 at 13:49
  • 1
    Well, a server misconfiguration. Hard to know more without knowing the server type, but are the certificate in the right order in the file? – Bruno Rohée Aug 19 '14 at 14:14
  • I had not noticed browsers to be willing to automatically download intermediates. Anyway, perhaps you have installed the intermediate into the store of certificates the server trusts, not the store that it sends to the client. Been there, done that. – jjanes Aug 19 '14 at 14:41

You have to configure your server to provide the chain certificate. How precisely to do this depends on your server.

For apache, you need to add to your config:

SSLCertificateChainFile /path/to/intermediate.crt

For IIS (and most other Windows-native stuff), you have to import the intermediate certificate into your server's "Intermediate Certification Authorities" certificate store.

For applications that don't support chain files in the configuration, you can append the intermediate certificates to your certificate file:

cat intermediate.crt >> mysite.com.pem

Be sure to only include the needed chain certificates and not the root certificate, as that would result in a "contains anchor" message. It would still work that way but it is not technically correct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.