Nginx does not provide intermediate certificates

User 1094128

I'm trying to install a ssl certificate on Nginx (Laravel Forge actually). I have connected the certificate with intermediate and there are no errors in the Nginx error log. However, it's not trusted in mobile Chrome - desktop only.

Looking at the Qualys ssl test, it says the chain is incomplete. I don't know how.

Here is my Nginx configuration

server {
listen 80;
server_name **********.com;
return 301 https://**********.com$request_uri;
}

server {
listen 443 ssl;
server_name **********.com;
root /home/forge/**********.com/public;

# FORGE SSL (DO NOT REMOVE!)
ssl on;
ssl_certificate /etc/nginx/ssl/**********.com/1086/server.pem;
ssl_certificate_key /etc/nginx/ssl/**********.com/1086/server.key;

index index.html index.htm index.php;

charset utf-8;

location / {
    try_files $uri $uri/ /index.php?$query_string;
}

location = /favicon.ico { access_log off; log_not_found off; }
location = /robots.txt  { access_log off; log_not_found off; }

access_log off;
error_log  /var/log/nginx/**********.com-error.log error;

error_page 404 /index.php;

location ~ \.php$ {
    fastcgi_split_path_info ^(.+\.php)(/.+)$;
    fastcgi_pass unix:/var/run/php5-fpm.sock;
    fastcgi_index index.php;
    include fastcgi_params;
}

location ~ /\.ht {
    deny all;
}
}

Can someone help? I've been pulling my hair out for days.

w

Looking at the Qualys ssl test, it says the chain is incomplete. I don't know how to...

It looks like you are sending the wrong intermediate:

$ openssl s_client -connect cauterypens.com:443
CONNECTED(00000003)
depth=0 C = GB, OU = Domain Control Validated, CN = cauterypens.com
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 C = GB, OU = Domain Control Validated, CN = cauterypens.com
verify error:num=27:certificate not trusted
verify return:1
depth=0 C = GB, OU = Domain Control Validated, CN = cauterypens.com
verify error:num=21:unable to verify the first certificate
verify return:1
---
Certificate chain
 0 s:/C=GB/OU=Domain Control Validated/CN=cauterypens.com
   i:/C=BE/O=GlobalSign nv-sa/CN=AlphaSSL CA - SHA256 - G2
 1 s:/O=AlphaSSL/CN=AlphaSSL CA - G2
   i:/C=BE/O=GlobalSign nv-sa/OU=Root CA/CN=GlobalSign Root CA
 ...

The subject of certificate 0 is CN=cauterypens.com. The issuer of certificate 0 is CN=AlphaSSL CA - SHA256 - G2.

The intermediate certificate should be the next certificate in the chain. However, you are not sending but CN=AlphaSSL CA - SHA256 - G2sending CN=AlphaSSL CA - G2. Note the missing in SHA256the name .

To fix this, you should get it AlphaSSL CA - SHA256 - G2from Download GlobalSign Root and Intermediate Certificate . It has thumbprint fingerprints ae:bf:32:c3:c8:32:c7:d7:bc:55:99:b1:aa:05:fb:6c:f4:d9:29:4c.

Related: CA is CN=GlobalSign Root CA. This is the GlobalSign Root R1download. Download and save it to a file (named Root-R1.crt). It's already in PEM encoding. Then you should be able to verify the chain using:

$ openssl s_client -connect cauterypens.com:443 -CAfile Root-R1.crt
...
Verify OK (0)

If there is no verification, then you have other troubles. Please fix the problem before continuing.

Related

Install intermediate CA certificates

Harvey I have a Kubernetes cluster hosting my own docker registry built with the following docs : https://github.com/kubernetes/kubernetes/tree/master/cluster/addons/registry and https://github.com/kubernetes/kubernetes /blob/master/cluster/addons/registry/tls

Are intermediate certificates cached in Firefox?

Kit Sunde If someone visits Site A with a GoDaddy-issued certificate that also provides an intermediate certificate between GoDaddy and its CA, then Firefox will cache that intermediate certificate and compare it with a site that also has a GoDaddy-issued cert

Are intermediate certificates cached in Firefox?

Kit Sunde If someone visits Site A with a GoDaddy-issued certificate that also provides an intermediate certificate between GoDaddy and its CA, then Firefox will cache that intermediate certificate and compare it with a site that also has a GoDaddy-issued cert

Verify signature without intermediate certificates

Lexicore Is it possible to verify signatures with only ancestor or root certificates in the hierarchy? Disclaimer: I'm new to certificate handling, so please forgive the simplistic terminology. Consider the following situation. We have two parties ( for the id

Verify signature without intermediate certificates

Lexicore Is it possible to verify signatures with only ancestor or root certificates in the hierarchy? Disclaimer: I'm new to certificate handling, so please forgive the simplistic terminology. Consider the following situation. We have two parties ( for the id

Heroku SSL: Install intermediate certificates?

Paul Sanwald My registrar gandi gave me the intermediate certificate to install, so I have 3 files: Private key file (server.key) Certificate file (mycert.crt) Intermediate Certificate (GandiSomething.pem) I am using SSL Beta service on heroku . heroku CLI her

Heroku SSL: Install intermediate certificates?

Paul Sanwald My registrar gandi gave me the intermediate certificate to install, so I have 3 files: Private key file (server.key) Certificate file (mycert.crt) Intermediate Certificate (GandiSomething.pem) I am using SSL Beta service on heroku . heroku CLI her

Verify signature without intermediate certificates

Lexicore Is it possible to verify signatures with only ancestor or root certificates in the hierarchy? Disclaimer: I'm new to certificate handling, so please forgive the simplistic terminology. Consider the following situation. We have two parties ( for the id

Verify signature without intermediate certificates

Lexicore Is it possible to verify signatures with only ancestor or root certificates in the hierarchy? Disclaimer: I'm new to certificate handling, so please forgive the simplistic terminology. Consider the following situation. We have two parties ( for the id

Nginx and SSL certificates

Lesha Ppiev I want to provide ssl support for my website under Nginx. First, I tried to use a self-signed certificate, but as you know, the browser complains The current connection cannot be trusted Second, I tried ordering a free certificate from a reputable

Nginx and SSL certificates

Lesha Ppiev I want to provide ssl support for my website under Nginx. First, I tried to use a self-signed certificate, but as you know, the browser complains The current connection cannot be trusted Second, I tried ordering a free certificate from a reputable

run subplots and provide intermediate variables

Ilya V. Schurov I have an autoencoder model in Tensorflow that can be roughly written (this is an unrealistic simplified example): x = tf.placeholder(tf.float32, input_shape, name='x') # encoder part: W = tf.Variable(tf.random_uniform(shape, -1, 1)) z = relu(

run subplots and provide intermediate variables

Ilya V. Schurov I have an autoencoder model in Tensorflow that can be roughly written (this is an unrealistic simplified example): x = tf.placeholder(tf.float32, input_shape, name='x') # encoder part: W = tf.Variable(tf.random_uniform(shape, -1, 1)) z = relu(

run subplots and provide intermediate variables

Ilya V. Schurov I have an autoencoder model in Tensorflow that can be roughly written (this is an unrealistic simplified example): x = tf.placeholder(tf.float32, input_shape, name='x') # encoder part: W = tf.Variable(tf.random_uniform(shape, -1, 1)) z = relu(

run subplots and provide intermediate variables

Ilya V. Schurov I have an autoencoder model in Tensorflow that can be roughly written (this is an unrealistic simplified example): x = tf.placeholder(tf.float32, input_shape, name='x') # encoder part: W = tf.Variable(tf.random_uniform(shape, -1, 1)) z = relu(

Obtain root and intermediate certificates from end entities

uprising: Still new to cryptography, I stumble across something simple every day. Today is just one of those days. I want to validate smime messages in Java using the bouncy castle library, I think I almost got it, but the current problem is the construction o

Chain get all certificates; intermediate and root

Neil Traft: I'm using Apache's HTTPClient in Java and trying to connect to graph.facebook.com. I get the "SSLPeerUnverifiedException: No peer certificate" error, so I guess Facebook's CA is not in the default keystore. So I need to create my own keystore with

Chain get all certificates; intermediate and root

Neil Traft: I'm using Apache's HTTPClient in Java and trying to connect to graph.facebook.com. I get the "SSLPeerUnverifiedException: No peer certificate" error, so I guess Facebook's CA is not in the default keystore. So I need to create my own keystore with

Python SSL server serving intermediate CA certificates

light I'm writing some server code using the Python (2.7) SSL module as follows: ssock = ssl.wrap_socket(sock, ca_certs="all-ca.crt", keyfile="server.key", certfile="server.crt", server_side=True, ssl_version=ssl.PROTOCOL_TLSv1) 'all-ca.crt' contains the signi

Client-Side SSL with Intermediate Certificates

Naftuli Kay I have a self signed root certificate and an intermediate certificate signed by that root. Basically something like this: . └── master (CA) └── servant1 (CA) I have some client certificates from master->servant1certificate chain : . └── master

Obtain root and intermediate certificates from end entities

uprising: Still new to cryptography, I stumble across something simple every day. Today is just one of those days. I want to validate smime messages in Java using the bouncy castle library, I think I almost got it, but the current problem is the construction o

Chain get all certificates; intermediate and root

Neil Traft: I'm using Apache's HTTPClient in Java and trying to connect to graph.facebook.com. I get the "SSLPeerUnverifiedException: No peer certificate" error, so I guess Facebook's CA is not in the default keystore. So I need to create my own keystore with

Python SSL server serving intermediate CA certificates

light I'm writing some server code using the Python (2.7) SSL module as follows: ssock = ssl.wrap_socket(sock, ca_certs="all-ca.crt", keyfile="server.key", certfile="server.crt", server_side=True, ssl_version=ssl.PROTOCOL_TLSv1) 'all-ca.crt' contains the signi