We have a secure server that seems to only be sending over the identity certificate. Running the hostname through Qualys says that only 1 cert was provided. The intermediate had to be downloaded on the fly. This is not a problem for browsers but we have a custom app which uses an SSL library to connect to these servers that can't build alternate paths or download certs on the fly. We have double checked and the server does have the proper certificates installed. Has anyone ever ran into this?
closed as unclear what you're asking by Gilles, TildalWave, Xander, AJ Henderson, Graham Hill Oct 20 '14 at 14:12
Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.
You have to configure your server to provide the chain certificate. How precisely to do this depends on your server.
For apache, you need to add to your config:
For IIS (and most other Windows-native stuff), you have to import the intermediate certificate into your server's "Intermediate Certification Authorities" certificate store.
For applications that don't support chain files in the configuration, you can append the intermediate certificates to your certificate file:
cat intermediate.crt >> mysite.com.pem
Be sure to only include the needed chain certificates and not the root certificate, as that would result in a "contains anchor" message. It would still work that way but it is not technically correct.