Re: Cannot get certificate chain to work.

[dE <de.techno@xxxxxxxxx>]

On 10/08/14 05:18, Igor Cicimov wrote:

On Wed, Oct 8, 2014 at 1:59 AM, dE <de.techno@xxxxxxxxx> wrote:

On 10/07/14 18:12, Igor Cicimov wrote:

On Tue, Oct 7, 2014 at 2:51 AM, dE <de.techno@xxxxxxxxx> wrote:

Hi.

I'm in a situation where I got 3 certificates

server.pem -- the end user certificate which's sent by the server to the client.
intermediate.pem -- server.pem is signed by intermediate.pem's private key.
issuer.pem -- intermediate.pem is signed by issuer.pem's private key.

combined.pem is created by --

cat server.pem intermediate.pem > combined.pem

Issuer.pem is installed in the web browser.

The chain is working, I can verify this via the SSL command --

cat intermediate.pem issuer.pem > cert_bundle.pem
openssl verify -CAfile cert_bundle.pem server.pem
server.pem: OK

However the browsers (FF, Chrome, Konqueror and wget) fail authentication, claiming there are no certificates to verity server.pem's signature.

I'm using Apache 2.4.10 with the following --

SSLCertificateFile /tmp/combined.pem
SSLCertificateKeyFile /tmp/server.key

Try this:

$ cat issuer.pem intermediate.pem > CA_chain.pem

  SSLCertificateFile server.pem
  SSLCertificateKeyFile server.key
  SSLCertificateChainFile CA_chain.pem

Tried this on Apache 2.2 (SSLCertificateChainFile does not work with 2.4) with the same issue.

 

Hmm in that case you have something mixed up or simply this can not work for self signed certificates since this is exactly what I'm using on Apache 2.2.24/26 on all our company web sites: a certificate signed by CA authority and a chain certificate file where the authorities CA and Intermediate certs have been concatenated.

Can you show us the output of:

openssl x509 -noout -in cert.pem -text

for all your sertificates?

$ openssl x509 -noout -in server.pem -text       
Certificate:
    Data:
        Version: 1 (0x0)
        Serial Number: 13192573755114198537 (0xb7156feedab91609)
    Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=AU, ST=Some-State, O=intermediate, CN=intermediate
        Validity
            Not Before: Oct  7 08:43:42 2014 GMT
            Not After : Oct  2 08:43:42 2015 GMT
        Subject: C=AU, ST=Some-State, O=server, OU=IT, CN=server
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (1024 bit)
                Modulus:
                    00:95:d3:1c:b7:ac:49:cc:38:2c:47:68:a2:b2:18:
                    6d:76:80:3c:9d:a2:03:cc:4b:df:c0:6e:81:3f:7a:
                    81:be:e1:38:34:5f:e0:1b:4e:e2:dc:a5:c6:d9:bb:
                    b0:86:3b:98:3d:e7:03:42:c7:a4:cb:05:f0:96:80:
                    e6:13:4e:bd:4f:e4:73:ea:72:7c:0c:90:23:7a:5e:
                    7a:46:7d:e7:64:3c:1d:54:7a:e6:d9:87:9d:e3:f8:
                    44:9c:df:08:64:d7:1d:a1:50:c3:fd:aa:9d:1b:84:
                    3e:cd:1d:b9:81:ba:70:6a:95:c7:63:ab:1b:7b:1f:
                    26:3f:36:cc:29:f0:69:2b:79
                Exponent: 65537 (0x10001)
    Signature Algorithm: sha1WithRSAEncryption
         4e:52:95:01:48:0f:c7:bd:51:6e:e6:9e:f6:3c:b4:16:10:a6:
         b5:75:2e:b2:49:bc:e7:50:46:d5:97:f1:e8:ed:b7:1d:b8:1a:
         33:2f:a3:7e:ca:41:1a:2a:74:4a:a3:81:04:99:c2:c8:76:ea:
         a6:91:8f:21:92:4c:62:ad:0c:57:43:73:b5:3c:0d:6c:82:cb:
         c1:c0:74:d8:ad:cb:12:1f:2f:9a:49:45:5a:06:05:fe:9a:13:
         b9:d3:e1:17:e6:67:88:18:fd:dc:c5:67:9a:94:9b:41:cf:0c:
         ca:88:4f:b5:fe:7e:e2:1e:61:db:4f:e1:bc:dc:f0:07:ad:1c:
         7c:fe


$ openssl x509 -noout -in intermediate.pem -text         
Certificate:
    Data:
        Version: 1 (0x0)
        Serial Number: 11894061023072807904 (0xa510317ba912ebe0)
    Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=AU, ST=Some-State, O=issuer, OU=signing, CN=issuer
        Validity
            Not Before: Oct  7 08:42:05 2014 GMT
            Not After : Oct  2 08:42:05 2015 GMT
        Subject: C=AU, ST=Some-State, O=intermediate, CN=intermediate
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (1024 bit)
                Modulus:
                    00:b6:52:95:bf:09:25:1b:dc:28:d9:b1:a8:24:f8:
                    f5:fb:f6:11:3e:22:74:f4:58:d1:dd:e3:4c:be:9a:
                    df:dc:e6:3a:6d:50:75:0f:87:6c:b9:f6:8a:cb:c6:
                    2d:df:2c:22:bf:17:f1:bd:94:78:8c:e4:ef:b3:82:
                    df:23:00:30:07:d7:59:9b:44:9b:2a:77:5f:85:40:
                    14:df:2f:89:66:7a:d5:e4:5a:d7:82:0c:bd:7c:6d:
                    78:36:c6:d9:8e:c1:31:24:44:35:9b:9d:47:50:69:
                    f2:d4:1b:5a:53:a5:e5:0e:d6:fc:ed:0e:60:15:b9:
                    3a:fd:f3:d1:f0:27:49:f4:c3
                Exponent: 65537 (0x10001)
    Signature Algorithm: sha1WithRSAEncryption
         0c:5d:ce:59:75:d2:1a:cb:0c:2a:04:c3:73:3e:4a:42:d5:2d:
         0f:84:5e:38:2c:5f:51:43:3a:ff:6e:17:b6:b1:3b:93:01:29:
         5b:28:4f:a7:ac:51:e4:22:8e:31:72:f4:89:cc:3a:37:2a:95:
         dc:11:96:70:28:c7:31:25:9e:6e:7f:ce:67:e4:3d:06:6a:de:
         96:df:33:32:e9:98:02:1a:a5:c6:b4:55:dc:2f:4a:2a:44:ec:
         51:59:0c:a1:92:dd:83:1d:ad:2b:4f:63:a4:68:4a:7f:f6:8c:
         8e:44:01:d6:60:95:8a:f1:dc:d4:7f:81:bc:36:12:15:5b:78:
         57:8d


$ openssl x509 -noout -in issuer.pem -text            
Certificate:
    Data:
        Version: 1 (0x0)
        Serial Number: 18284349327322698662 (0xfdbf0ed6ac38d3a6)
    Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=AU, ST=Some-State, O=issuer, OU=signing, CN=issuer
        Validity
            Not Before: Oct  7 08:40:29 2014 GMT
            Not After : Oct  7 08:40:29 2015 GMT
        Subject: C=AU, ST=Some-State, O=issuer, OU=signing, CN=issuer
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (1024 bit)
                Modulus:
                    00:bc:b7:71:69:93:a3:17:ed:29:e3:c6:32:ac:18:
                    7d:ec:ea:88:0b:51:ef:4b:0e:16:7b:77:a8:cf:e2:
                    72:4b:0c:94:e7:08:17:9f:a0:22:2c:ac:cb:0b:89:
                    26:04:59:75:46:c2:56:b6:81:b5:1c:26:f1:eb:8d:
                    af:17:08:25:14:72:2b:b0:91:f6:12:7f:a4:9f:41:
                    e0:44:1a:1f:00:60:e2:35:e5:d8:39:4c:1f:3d:97:
                    d5:76:4d:cf:70:c8:34:fd:06:06:6e:88:34:eb:49:
                    af:b9:96:71:89:c4:9b:f4:14:f5:91:32:23:67:b9:
                    05:d0:5c:50:0f:8f:3f:c4:d5
                Exponent: 65537 (0x10001)
    Signature Algorithm: sha1WithRSAEncryption
         3f:c6:9c:5d:28:43:3d:8a:9c:8c:24:96:19:ec:66:97:59:a9:
         70:79:c9:60:59:36:47:66:22:1a:cb:6e:8e:ac:dd:97:42:5c:
         96:30:40:77:60:49:3c:07:0d:02:b2:96:c6:8d:1f:ee:62:38:
         82:3c:ec:f4:d1:b2:4c:16:5e:84:fc:c8:ab:c6:b1:ac:99:82:
         9a:be:3f:e4:b9:58:fd:8b:fd:9f:1e:fb:9f:39:05:11:1e:62:
         f2:08:e9:ed:c5:dc:b3:ef:71:38:fa:1d:a7:9d:2d:96:c5:c9:
         40:b1:cb:30:45:2f:f4:80:5b:23:0a:bf:b5:a3:5a:b4:4f:4a:
         68:bf