Website Certificate with different public key

Question

I've installed a ssl certificate from https://www.startssl.com/ in a server running with plesk. The website is the following: https://refood.sal-pimenta.pt/

As you can see the certificate is fine but not that good in terms of security (sha1 and 2048 Bits key), and this fact is pointed out if you use Chrome. This is really odd because the certificate I have in my PC, the one I uploaded to the server, as sha256RSA for signature with a key of 4096 Bits.

I checked the public keys and they are obviously different, as well as the certificate CA.

Is this normal? Thanks for your time and I'm sorry if this not that related to cryptography but it seemed the right place to ask.

Answer 1

This would have been better here.

However we can still answer your question.
I inspected the site you referred to and the reason, why chrome shows you a security warning is because the intermediate certificate of StartSSL uses SHA-1 for signature-hashing.

Your certificate is in fact SHA-256/RSA-4096 as claimed, but because one certificate in the chain (the intermediate certificate) is "weak", the whole chain is considered "weak" and hence you get a warning.

Answer 2

I've found the answer for this in another post: Why is 'avast! Web/Mail Shield Root' listed as CA for google.com?

The problem was that my Antivirus that was creating it's certificate (not that secure, but irrelevant because it's between Avast and the Browser only) and making chrome say that. Everything is fine with the certificate.

Thanks for the answers and I hope this helps more people with this stupid doubt.