Incomplete certificate chain


There are 3 methods to test the incomplete certificate chain:

1) https://www.ssllabs.com/ssltest/analyze.html?d=example.com
The error is:
Chain issues Incomplete

2) curl -v -o /dev/null https://example.com
The error is:
* NSS error -8179 (SEC_ERROR_UNKNOWN_ISSUER)
* Peer’s Certificate issuer is not recognized.

3) openssl s_client -showcerts -verify 10 -connect example.com:443
The error is:
Verify return code: 21 (unable to verify the first certificate)

Reference:
http://en.wikipedia.org/wiki/Intermediate_certificate_authorities
https://degreesofzero.com/article/how-to-fix-missing-intermediate-ssl-certificate-errors-in-apache.html
http://curl.haxx.se/docs/sslcerts.html

Advertisement

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s