SSL certificates: wrong order


Vojtech

I have an SSL EV certificate for https://goout.cz . According to this test, we get an A+:

https://www.ssllabs.com/ssltest/analyze.html?viaform=on&d=goout.cz

However, I get the "Wrong order, contains anchors" warning.

But this test is : https://cryptoreport.websecurity.symantec.com/checker/views/certCheck.jsp

Says: The certificate was not installed correctly.

So far I can't find the problem. I thought I might have connected the main and intermediate certificates by mistake, but I checked that the main certificate was first, then the intermediate certificates.

thanks.

Law 29

Your file should contain

  1. your certificate
  2. The intermediate certificate that signed your certificate
  3. any other intermediate certificates, in order

Your file should not contain root certificates.

To put it another way:

  • The subject of certificate 0 should be you
  • The issuer of certificate 0 should be equal to the subject of certificate 1
  • The issuer of certificate 1 should be equal to the subject of certificate 2
  • ...
  • The issuer of certificate n should be equal to the subject of the root
  • The issuer of the root should by definition be the same as its subject (otherwise, it is not a root certificate).

Are you using linux with openssl? If so, I can provide a script to check.

I just connected to your website using

$ openssl s_client -showcerts -connect goout.cz:443 2> /dev/null | grep ' [0-9 ] [is]:'
 0 s:/serialNumber=01901613/jurisdictionC=CZ/jurisdictionST=Prague/jurisdictionL=Prague 3/businessCategory=Private Organization/C=CZ/postalCode=130 00/ST=Prague/L=Prague 3/street=Husinecka 792/25/O=GoOut s.r.o./OU=Technical/OU=COMODO EV SSL/CN=goout.cz
   i:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Extended Validation Secure Server CA
 1 s:/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root
   i:/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root
 2 s:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Certification Authority
   i:/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root
 3 s:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Extended Validation Secure Server CA
   i:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Certification Authority
^C

It looks like you have a file with four certificates, and to get a perfect grade, you should delete the second certificate and exchange the last two.

Related


SSL certificates: wrong order

Vojtech I have an SSL EV certificate for https://goout.cz . According to this test, we get an A+: https://www.ssllabs.com/ssltest/analyze.html?viaform=on&d=goout.cz However, I get the "Wrong order, contains anchors" warning. But this test is : https://cryptore

Java and SSL certificates

Andy: I'm trying to use Secure Sockets Layer (HTTPS) to connect to a PHP script in Java, but I've found that for maximum security/validity I have to import the SSL certificate used by the website into my application. ..I do not know what to do. If it helps, my

Where are SSL certificates stored?

iOS Monkey I understand how SSL works, but my question is more about the storage of certificates on the client side. To understand the exact context, let's assume I'm writing my own browser. My rendering part will be done by WebKit and the HTTP request handlin

Where are SSL certificates stored?

iOS Monkey I understand how SSL works, but my question is more about the storage of certificates on the client side. To understand the exact context, let's assume I'm writing my own browser. My rendering part will be done by WebKit and the HTTP request handlin

SSL certificates break CSS

Sam Recently purchased an SSL certificate, but the site doesn't seem to be able to load the site CSS. Here is the link https://www.rentpayment.com/ By looking at the console error message this seems to be the problem: <link rel="stylesheet" href="http://www.re

Java and SSL certificates

Andy: I'm trying to use Secure Sockets Layer (HTTPS) to connect to a PHP script in Java, but I've found that for maximum security/validity I have to import the SSL certificate used by the website into my application. ..I do not know what to do. If it helps, my

Pinning SSL certificates with libcurl

SP Miguel Jenner I wonder if this example is enough to provide a way to do certificate pinning with libcurl : http://curl.haxx.se/libcurl/c/cacertinmem.html Because I found out that curl also allows http://curl.haxx.se/libcurl/c/CURLOPT_PINNEDPUBLICKEY.html Si

Certificates returned by free SSL

O. Shekri Raz Today I installed a free ssl certificate on my website and it was easy, but I have some questions about it. FreeSSL returned three files: "private.key", "certificate.crt", "ca_bundle.crt". So there are my questions: 1) Who does this private key b

Where are SSL certificates stored?

iOS Monkey I understand how SSL works, but my question is more about the storage of certificates on the client side. To understand the exact context, let's assume I'm writing my own browser. My rendering part will be done by WebKit and the HTTP request handlin

SSL certificates and links

Eric Sometimes I use elink for web browsing and it happens that some HTTP sites fail to load due to it SSL error. An example is https://www.rust-lang.org , which doesn't load in elink but works fine on other browsers like Chrome and firefox. Checking the https

SSL certificates break CSS

Sam Recently purchased an SSL certificate, but the site doesn't seem to be able to load the site CSS. Here is the link https://www.rentpayment.com/ By looking at the console error message this seems to be the problem: <link rel="stylesheet" href="http://www.re

SSL certificates break CSS

Sam Recently purchased an SSL certificate, but the site doesn't seem to be able to load the site CSS. Here is the link https://www.rentpayment.com/ By looking at the console error message this seems to be the problem: <link rel="stylesheet" href="http://www.re

SSL certificates break CSS

Sam Recently purchased an SSL certificate, but the site doesn't seem to be able to load the site CSS. Here is the link https://www.rentpayment.com/ By looking at the console error message this seems to be the problem: <link rel="stylesheet" href="http://www.re

SSL certificates break CSS

Sam Recently purchased an SSL certificate, but the site doesn't seem to be able to load the site CSS. Here is the link https://www.rentpayment.com/ By looking at the console error message this seems to be the problem: <link rel="stylesheet" href="http://www.re

SSL certificates break CSS

Sam Recently purchased an SSL certificate, but the site doesn't seem to be able to load the site CSS. Here is the link https://www.rentpayment.com/ By looking at the console error message this seems to be the problem: <link rel="stylesheet" href="http://www.re

Nginx and SSL certificates

Lesha Ppiev I want to provide ssl support for my website under Nginx. First, I tried to use a self-signed certificate, but as you know, the browser complains The current connection cannot be trusted Second, I tried ordering a free certificate from a reputable

Uniquely identify SSL certificates

Mamadou I would like to know how to determine that a given file is an SSL certificate. Is the file extension sufficient to determine if the file is a certificate? Maarten Bodewes An SSL certificate is nothing more than an X.509 version 3 certificate with some

SSL certificates and redirects

Arjun Tuli If I'm redirecting a website, does the originating domain need to have an SSL certificate, or does it have the redirected domain, or both? Ian Roberts Both, because redirection is an HTTP level thing, happening inside the SSL envelope. The client ne

SSL certificates in different ports

Azamat Hi! My problem: I am using a web application with an SSL certificate in port 443 and this application has a web service in javascript. The web service connects on a different port 7443 and uses the same certificate. But the certificate is not added to p

2 twisted SSL certificates

calombo I have the following code: from twisted.web.server import Site from twisted.web.static import Data from twisted.internet import reactor, ssl root = Data("", "text/plain") site = Site(root) reactor.listenSSL(config.ws_port, site,

Two SSL certificates

Jack Walker I have 2 Windows IIS servers (live and backup) running Wordpress site hosting. The goal is to be able to switch to a backup server in the event of a live server failure. I can do this now by putting the live server's IP on the backup server. No pro

2 twisted SSL certificates

calombo I have the following code: from twisted.web.server import Site from twisted.web.static import Data from twisted.internet import reactor, ssl root = Data("", "text/plain") site = Site(root) reactor.listenSSL(config.ws_port, site,

Signing certificates and SSL

Johnny Burr I currently have a Java upload applet on a website hosted by Hostgator; however, the browser blocks the Java applet from executing when the page is accessed. The reason given is that the security settings are preventing the SELF-SIGNED application

HTTPS and SSL certificates

Marin 74 I developed a website using Symfony2 and put it into HTTPS. I have some questions: The only way to go to my website without an error message on the browser is to have an SSL certificate? How is the SSL certificate installed on the website? The price o

SSL certificates are only valid

Steven Morad Similar to Intermediate SSL Certificate I have a router running squid cache. The point is, everything is https these days, so I have MITM SSL filtering enabled to cache https. I'm fairly sure this is terminating SSL at the router and not at my PC.

Nuts (UPS) and SSL certificates

Mausy5043 Today I nutinstalled it on my Ubuntu server (Ubuntu 14.04 LTS). $ uname -a Linux boson 3.13.0-24-generic #47-Ubuntu SMP Fri May 2 23:30:00 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux The UPS is connected to another server (called "neutron"), so I nut-cl

Are wildcard SSL certificates recommended?

Sivalingaamorthy I'm in the following domains, is there a benefit to buying a single wildcard certificate? Or do I need to buy a separate SSL certificate. abc.example.com。au abc.example.com。nz abc.api.module.example.com abc.api.global.example.com Are there any

Java and SSL certificates

Andy: I'm trying to use Secure Sockets Layer (HTTPS) to connect to a PHP script in Java, but I've found that for maximum security/validity I have to import the SSL certificate used by the website into my application. ..I do not know what to do. If it helps, my

LDAP to store SSL certificates

Daniel I am using OpenDS as LDAP server. Is it possible to store SSL certificates for multiple applications (Tomcat/Apache web server etc) in LDAP? I don't think "userCertificate" is the right choice. Can this be handled by an extension? Thanks in advance. Reg