4

So I bought a Comodo SSL from Namecheap and put my site up on a Ubuntu droplet on DigitalOcean on a nginx server.

My default virtual host file on /etc/nginx/sites-available/:

server {
       listen         80;
       server_name    www.navarra-rpg.com;
       return         301 https://www.----------.com$request_uri;
}

server {

    listen 443 ssl;

    root /var/www/--------.com/html;
    index index.html index.htm;

    ssl_certificate /etc/nginx/ssl/ssl-bundle.crt;
    ssl_certificate_key /etc/nginx/ssl/---------.key;

    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;

    ssl_prefer_server_ciphers on;
    ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS;

    server_name www.navarra-rpg.com;

    location / {
        try_files $uri $uri/ =404;
    }
}

Here are the four files I recieved:

  • AddTrustExternalCARoot.crt
  • COMODORSAAddTrustCA.crt
  • COMODORSADomainValidationSecureServerCA.crt
  • navarra-rpg_com.crt

Of course, I then used the command to bundle them all up nicely to get the bundled certificate plus the key when I used the openssl req command.

Now, when I go to DigiCert's site to test and I type in my address... it says that I installed it correctly.

I checked out my cert installation to make sure I got the chain right:

  • Comodo RSA Certification Authority
    • Comodo RSA Domain Validation Secure Server CA
      • ----------.com

I used the following command from this guide to get the ssl bundle cert.:

cat ---------_com.crt COMODORSADomainValidationSecureServerCA.crt COMODORSAAddTrustCA.crt AddTrustExternalCARoot.crt > ssl-bundle.crt

Why isn't my website showing up securely on my Android mobile but is on my desktop?

I get NET::ERR_CERT_AUTHORITY_INVALID error on my phone along with upon pressing the NET:ERR_CERT_AUTHORITY_INVALID error

  • which android verison? Also you should look to remove SSLv3 support this is widely considered insecure. – Oneiroi Jun 18 '15 at 14:01
  • @Oneiroi Will be sure to do that. Which android? Latest version. I Am on Samsung Galaxy S6... >_< – Gao Lin Jun 18 '15 at 14:03
  • Ok we can assume Android 5.x in this case; and if you go to navarra-rpg.com via youy Android what do you see in the browser? any indicators as to the error would be helpful (screenshot would be ideal) – Oneiroi Jun 18 '15 at 14:16
  • @Oneiroi I added in my mobile error on the original post. – Gao Lin Jun 18 '15 at 14:26
1

You can find some more information by "tapping" NET::ERR_CERT_AUTHORITY_INVALID on the first page see this example here: https://www.youtube.com/watch?v=o8iJE7p-W4M

In short NET::ERR_CERT_AUTHORITY_INVALID indicates the certificate authority is not trusted by your Android device.

Try opening a support case with the CA (Comodo), a quick google seems this is not an uncommon issue for comodo certs.

Check https://stackoverflow.com/questions/11340298/certificate-trusted-on-pc-but-not-in-android

Also for secure SSL nginx configuration refer to: https://wiki.mozilla.org/Security/Server_Side_TLS

  • 1
    It worked. :) I got a cert from Comodo and it was all good. – Gao Lin Jun 18 '15 at 20:28
  • +1 for security link that also helps with performance. – Marcelo Agimóvel Nov 24 '18 at 13:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.