Can I modify my certificate chain?

Question

I've had SSL/TLS running on my site now for a while. In order to learn a bit more about general PKI, I studied Qualys' SSL test, and optimised my configuration (including the adoption of OCSP stapling).

My specific web server of choice is Nginx - and there is the option ssl_trusted_certificate, which, if I'm not mistaken, allows an OCSP response's signature to be validated. As far as I know, this is a chain that goes from the CA's root certificate, down to the final intermediate certificate before your server's "acting" certificate (I forgot the proper name for these!).

In my specific situation, I'm using Gandi as a certificate provider. I got two different certification paths according to the test. The USERTRUST root (which issued the Gandi intermediate certificate), didn't seem to work on some devices (recent phones, I found an instance of Android 4.4.4 didn't have the certificate installed), so I opted for the longer chain, with AddTrust at the root (which issued a USERTRUST cert., which in turn issued the Gandi cert., and finally my server's own).

This resolved the issue. However, I'm wondering whether or not this is recommended to deviate from the given bundle provided by Gandi? Also, getting back to OCSP, my OCSP URI turns out to be http://ocsp.usertrust.com.

If I was just blindly changing ssl_trusted_certificate, I'd put the AddTrust root, the USERTRUST intermediate, and finally the Gandi intermediate certificates in that order (I can't find any documentation that goes into which order I specifically need it in, and which certificates I actually need to include).

If my OCSP responses are coming from USERTRUST, do I just need the USERTRUST root, and the Gandi intermediate?

Thanks for taking the time to read. :)

Answer 1

(I can't find any documentation that goes into which order I specifically need it in, and which certificates I actually need to include).

RFC5246 is pretty clear on this:

certificate_list
  This is a sequence (chain) of certificates.  The sender's
  certificate MUST come first in the list.  Each following
  certificate MUST directly certify the one preceding it.  Because
  certificate validation requires that root keys be distributed
  independently, the self-signed certificate that specifies the root
  certificate authority MAY be omitted from the chain, under the
  assumption that the remote end must already possess it in order to
  validate it in any case.

However, I'm wondering whether or not this is recommended to deviate from the given bundle provided by Gandi?

Why would you like to deviate from this? If Gandi is the CA that issued your certificate, you should definitely use its OCSP responder. Any OCSP responder further up in that chain is not responsible for any certificates issued by Gandi. After all, nobody (but Gandi) knows the private key, which is needed to sign the OCSP responses with (and/or the certificate that is used to sign OCSP responses).