Isn't this a broken certificate chain?

Question

My certificate provider responded to my CSR with four certificates, the first being "ours", and the remaining three presumably to build a chain of trust.

I've never had to investigate (and prove to my provider) a certificate chain at this level, so I'm open to being told I'm not looking at the proper information.

My certificate has

Issuer: C=US, ST=New Jersey, L=Jersey City, O=The USERTRUST Network, CN=USERTrust RSA Domain Validation Secure Server CA

with

X509v3 Authority Key Identifier: keyid:A6:C1:E7:E1:F4:F6:47:63:D7:2F:7D:8D:90:F8:BA:23:4F:60:AC:9E

What they sent me to build the chain are:

1. Subject: C=US, O=Register.com, CN=Register.com CA SSL Services (DV)

   Issuer: C=US, ST=UT, L=Salt Lake City, O=The USERTRUST Network, OU=http://www.usertrust.com, CN=UTN-USERFirst-Hardware

   X509v3 Subject Key Identifier: 96:36:9B:F8:D6:E5:B3:68:4A:70:7A:7A:72:8D:D3:6E:2C:0B:B9:31

   X509v3 Authority Key Identifier: keyid:A1:72:5F:26:1B:28:98:43:95:5D:07:37:D5:85:96:9D:4B:D2:C3:45

2. Subject: C=US, ST=UT, L=Salt Lake City, O=The USERTRUST Network, OU=http://www.usertrust.com, CN=UTN-USERFirst-Hardware

   Issuer: C=SE, O=AddTrust AB, OU=AddTrust External TTP Network, CN=AddTrust External CA Root

   X509v3 Subject Key Identifier: A1:72:5F:26:1B:28:98:43:95:5D:07:37:D5:85:96:9D:4B:D2:C3:45

   X509v3 Authority Key Identifier: keyid:AD:BD:98:7A:34:B4:26:F7:FA:C4:26:54:EF:03:BD:E0:24:CB:54:1A

3. Subject: C=SE, O=AddTrust AB, OU=AddTrust External TTP Network, CN=AddTrust External CA Root

   Issuer: C=SE, O=AddTrust AB, OU=AddTrust External TTP Network, CN=AddTrust External CA Root

   X509v3 Subject Key Identifier: AD:BD:98:7A:34:B4:26:F7:FA:C4:26:54:EF:03:BD:E0:24:CB:54:1A

   X509v3 Authority Key Identifier: keyid:AD:BD:98:7A:34:B4:26:F7:FA:C4:26:54:EF:03:BD:E0:24:CB:54:1A

Since the AKID in my certificate is not an SKID in the chain they provided, my certificate fails to authenticate right away.... right?

Answer 1

Key identifiers are extensions meant to help with certificate path building, but a mismatch does not imply a validation failure (at least as far as X.509 / RFC 5280 is concerned -- what implementations do is another matter).

However, the subject/issuer DN must match in a valid chain, and a mismatch implies immediate rejection. If you have a certificate whose "issuer DN" is "C=US, ST=New Jersey,...", then the immediately preceding certificate in the chain (the certificate for that CA that issued your certificate) must have that exact name in its "subject DN". From what you tell, none of the certificates they sent you fulfils this property.