Certificates signed by Intermediate appear as self-signed certificates

username

I'm currently migrating my service hosting from managed hosting (running Lighspeed + Cpanel) to my own managed hosting (running Nginx).

Everything works fine with Nginx 1.6.0, but my problem is that my certificate shows up as self-signed . I followed http://www.digicert.com/ssl-certificate-installation-nginx.htm to install the SSL certificate including the chain certificate

However, even trying to configure on NGinx SSL certificate authentication signed by an intermediate CA (chain) it doesn't work.

If I put my website on it, http://sslcheck.globalsign.com/en_USit says it's a self-signed certificate.

Here is my virtual host configuration regarding SSL:

server {
    listen       80;
    listen  443 ssl;

    server_name    host02.website.com *.website.com;
    root           /spacedata/website.com;
    index index.php index.html /;

    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_prefer_server_ciphers on;
    ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-RC4-SHA:ECDHE-RSA-AES128-SHA:AES128-SHA:RC4-SHA;
    ssl_session_cache shared:SSL:10m;

    add_header Strict-Transport-Security max-age=31536000;

    ssl_certificate /etc/pki/tls/certs/bundle-alpha.crt;
    ssl_certificate_key /etc/pki/tls/certs/private.key;
    ...
}

I confirmed that I have the correct certificate and private key installed.

Remember, I run AlphaSSLwildcard certificates.

I suspect that I'm missing something in the configuration because in other hosts where I have the same .crt file and .key installed.

Flip Vernooij

I had the same problem before and had to deal with the order of certificates in the ssl_certificate file. You need to include all intermediate CA certificates in this file, in the correct order. All I had to do was reverse the order of the certificates in that file and my problem was solved.

Your server certificate should be the most important and then go straight to the CA chain.

PS. My config looks like:

listen 443 default ssl;
ssl_certificate /etc/nginx/ssl/server_plus.crt;
ssl_certificate_key /etc/nginx/ssl/server.key;
ssl_session_timeout 5m;
ssl_protocols SSLv3 TLSv1;
ssl_ciphers ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv3:+EXP;
ssl_prefer_server_ciphers on;

Related

Trusted SSL certificates appear as self-signed

Oracle: I have a trusted TLS certificate provided by DigiCert that I am trying to use in a java/spring application exposing the rest api. I created a .p12 file with openssl which does the following:openssl pkcs12 -export -in mycertificate.cer -certfile mycerti

SSL: Understanding Self-Signed Certificates

Leviathan I would like to know how self-signed certificates are normally checked in SSL connection establishment. Let's take a look self-signed certificates: Client and server provide it with a self-signed certificateprivate key (e.g. created with OpenSSL) Whe

Use Httpclient to trust self-signed certificates

wood more wood I'm trying to make a web request that fails due to a self-signed certificate: Client = new HttpClient(); HttpResponseMessage Response = await Client.GetAsync(Uri)//defined elsewhere This will throw a trust failure exception. I tried allowing

How to unblock self-signed SSL certificates?

VK1 Issue: User cannot log in to mobile app due to "Unable to contact server" Debug message: "TypeError: network request failed" Attempted fixes: restarted the server, verified that the db was running and nothing changed, restarted the VM the server was runnin

Allow self-signed certificates with WKWebView

Ricardo I have the following code but I don't know why my web view is not loading. override func viewDidLoad() { super.viewDidLoad() loadWebview(env_url:"https://myurl.com") } func loadWebview(env_url : String){ let config = WKWebViewConfiguratio

ActionMailer: Using multiple self-signed certificates

K-Sato I found this question about how to use a self-signed certificate for ActionMailer in stackoverflow. According to the answer, it can be done with the following code. config.action_mailer.smtp_setting = { ... ssl: true enable_starttls_auto: fa

List of self-signed certificates on the server

Fumimori Sa Is there a way to list all the self-signed certificates on the server, or can verify that the port's certificate is a self-signed certificate? Ulrich Schwarz All certificates are difficult because technically each server software can have its own c

Android ignores self-signed certificates

Ravi My Android app is connecting to a https self-signed server and it works fine with a client certificate (.cer file). It is possible to connect an Android App to a https self-signed server without using a client certificate. -> If the answer is "yes", which

Accept HTTPS connections with self-signed certificates

Morten I'm trying to use the HttpClientlib for HTTPS connections, but the problem is that since the certificate is not signed by a recognized certificate authority (CA) , such as Verisign , GlobalSIgn , etc., which lists a set of Android trusted certificates,

ActionMailer: Using multiple self-signed certificates

K-Sato I found this question about how to use a self-signed certificate for ActionMailer in stackoverflow. According to the answer, it can be done with the following code. config.action_mailer.smtp_setting = { ... ssl: true enable_starttls_auto: fa

Use Httpclient to trust self-signed certificates

wood more wood I'm trying to make a web request that fails due to a self-signed certificate: Client = new HttpClient(); HttpResponseMessage Response = await Client.GetAsync(Uri)//defined elsewhere This will throw a trust failure exception. I tried allowing

Make Guzzle trust self-signed certificates?

TheStoryCoder Using the Guzzle HTTP client, I know you can set new GuzzleClient(['verify' => false])to not check the certificate, eg. When you use a self-signed certificate. But how do you make it accept and trust specific self-signed certificates so that you

How to unblock self-signed SSL certificates?

VK1 Issue: User cannot log in to mobile app due to "Unable to contact server" Debug message: "TypeError: network request failed" Attempted fixes: restarted the server, verified that the db was running and nothing changed, restarted the VM the server was runnin

Trust self-signed PEM certificates

Mother Teresa and the Teenager I have setup a proxy server with SSL using PEM certificate. Now, there are several machines where I would like this certificate to be automatically trusted (and the web browser doesn't complain). How to install PEM certificate on

Trust self-signed PEM certificates

Mother Teresa and the Teenager I have setup a proxy server with SSL using PEM certificate. Now, there are several machines where I would like this certificate to be automatically trusted (and the web browser doesn't complain). How to install PEM certificate on

Android SSLSockets using self-signed certificates

snapshot This is a problem I've been wrestling with lately, mostly because I feel like there's just too much information on the Internet about this problem to help me . So since I just found a solution that works for me, I decided to post the question and solu

Are self-signed SSL certificates less secure?

Aloso I'm using a self-signed SSL certificate on the front page for the prom. I know almost everyone uses the site personally, so even if the browser shows a warning, I can assure them that the certificate is trusted. The question is: if I use this self-signed

Handling self-signed certificates with NSURLConnection

Willam Hill I want to allow self-signed certificates with NSURLConnection, provided the host is on the trusted list. I see a lot of people doing things like this: - (BOOL)connection:(NSURLConnection *)connection canAuthenticateAgainstProtectionSpace:(NSURLProt

Handling self-signed certificates with NSURLConnection

Willam Hill I want to allow self-signed certificates with NSURLConnection, provided the host is on the trusted list. I see a lot of people doing things like this: - (BOOL)connection:(NSURLConnection *)connection canAuthenticateAgainstProtectionSpace:(NSURLProt

SSL: Understanding Self-Signed Certificates

Leviathan I would like to know how self-signed certificates are normally checked in SSL connection establishment. Let's take a look self-signed certificates: Client and server provide it with a self-signed certificateprivate key (e.g. created with OpenSSL) Whe

OpenSsl and Self-Signed Certificates - Verification Chain

Matt I have an iron chain. -----BEGIN CERTIFICATE----- // My server cert signed by intemediate CA -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- // My intermediate cert signed by root CA -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- // My self s

Troubleshoot untrusted self-signed certificates

CJ Dennis I've created a self-signed certificate for use on my Windows 10 development machine, and I've added it to the Trusted Root Certification Authorities/Certificates suggested by " How to Install an Apache Self-Signed Certificate on YouTube's Windows 10

Trusted SSL certificates appear as self-signed

Oracle: I have a trusted TLS certificate provided by DigiCert that I am trying to use in a java/spring application exposing the rest api. I created a .p12 file with openssl which does the following:openssl pkcs12 -export -in mycertificate.cer -certfile mycerti

Accept HTTPS connections with self-signed certificates

Morten I'm trying to use the HttpClientlib for HTTPS connections, but the problem is that since the certificate is not signed by a recognized certificate authority (CA) , such as Verisign , GlobalSIgn , etc., which lists a set of Android trusted certificates,

List of self-signed certificates on the server

Fumimori Sa Is there a way to list all the self-signed certificates on the server, or can verify that the port's certificate is a self-signed certificate? Ulrich Schwarz All certificates are difficult because technically each server software can have its own c

Use Httpclient to trust self-signed certificates

wood more wood I'm trying to make a web request that fails due to a self-signed certificate: Client = new HttpClient(); HttpResponseMessage Response = await Client.GetAsync(Uri)//defined elsewhere This will throw a trust failure exception. I tried allowing

How to unblock self-signed SSL certificates?

VK1 Issue: User cannot log in to mobile app due to "Unable to contact server" Debug message: "TypeError: network request failed" Attempted fixes: restarted the server, verified that the db was running and nothing changed, restarted the VM the server was runnin

Allow self-signed certificates with WKWebView

Ricardo I have the following code but I don't know why my web view is not loading. override func viewDidLoad() { super.viewDidLoad() loadWebview(env_url:"https://myurl.com") } func loadWebview(env_url : String){ let config = WKWebViewConfiguratio

Self-signed certificates appear as untrusted sources in signTool

Vladimir Yanakiev I use signTool to make my own certificate like powershell.exe New-SelfSignedCertificate -DnsName "www.mydns.me" -Type CodeSigning -NotBefore 27.10.2021 -NotAfter 27.10.2024 -CertStoreLocation "cert:\CurrentUser\My" The certificate is availab