SSL certificate chain resolver

https://github.com/zakjan/cert-chain-resolver

by zakjan • 12 years ago

41 16 12 years ago

laurencei• 12 years ago

Useful script.

A related post worth reading is "Getting an A+ on Qualy's SSL Labs Tester" - https://sethvargo.com/getting-an-a-plus-on-qualys-ssl-labs-t...

Previous HN discussion: https://news.ycombinator.com/item?id=8749931

jayess• 12 years ago

Thank you for that A+ link, it's very useful.

nadams2• 12 years ago

That is what I suspected - in order to get an "A+" you have to recompile the web server (the article is for nginx but the same idea applies to Apache). I'm not saying this is a difficult process - but not something I want to do on a production system.

While, distro maintainers usually do a great job of maintaining software - I think it does highlight a certain need for another way to easily install bleeding edge without adding a whole other repo (which could contain/override versions of other software you may not want). You can always rpm/dpkg an individual package - but now your version will never been updated by the package manager, well by yum update/apt-get upgrade anyways (or even worse overwritten).

iancarroll2• 12 years ago

No. If you force HSTS it raises an A to an A+, which requires no recompiling.

Do PPAs not fit your use case?

peterwaller• 12 years ago

I've lost count of how many times I had to try reordering the certificates I fed to Amazon's load balancer. You get back very cryptic error messages. Which is annoying since it could almost certainly work out the order for you...

This script looks very useful, thanks :)

zakjan3• 12 years ago

Happy to help. Can you check if it works for you? Thanks :)

praseodym• 12 years ago

One thing to note is that the Qualys SSL Labs test will complain if your server sends the (self-signed) root CA certificate, which will already be in the end-user's trust store. This uses unnecessary bandwidth for every TLS negotiation.

In many cases, the CA (or company you got your certificate from) will include this root cert in the chain. With most web servers it is perfectly fine to simply remove it, but I have seen applications where you cannot (VMware, which wants a complete chain ending with a self-signed cert) and where you'll have to ignore the SSL Labs warning.

zakjan3• 12 years ago

Yes, you are right, a root cert shouldn't be sent by server. My script doesn't append it to output, because (I hope) no intermediate certificate has AIA extension pointing to the root cert. If you find a counterexample, please file an issue, I will add a check.

iancarroll2• 12 years ago

A tangent of this is where you will get many irrelevant warnings due to compatibility chains. Comodo uses "Comodo <keytype> Certification Authority" but this has to be sent with your request as not all clients trust it, but they will trust the issuer.

jpetersonmn• 12 years ago

I just went through this issue with my first site I've used ssl on. I thought everything was all good until I visited the site on my phone and got cert errors. Took me all night to figure out how to get them in the correct order, etc... Thanks for sharing this.

est2• 12 years ago

SSL is hard not only because the pricing barrier, but also setup hassle like these. Thanks OP!

Tortoise• 12 years ago

These people will sell you a cert for US$5 per year:

https://cheapsslsecurity.com/comodo/positivessl.html

If that's a barrier, I don't know what to say. Registering the domain name probably costs twice that.

est2• 12 years ago

Well, guess what, not everyone has credit card, payment methods are not available in every country.

cfcf• 12 years ago

thank you very much for this! Added a pull request to fix some issues with relative paths :)

zakjan3• 12 years ago

Thanks for your contribution!

SSL certificate chain resolver

Related Stories