Nginx – SSL will not work on Android mobile

androidmobile-devicesnginxssl

I bought Comodo SSL from Namecheap. Now, the SSL works fine on desktop, I am getting a "This Connection is not private" on mobile phone.. on my chrome on Android

Here is my virtual host file:

server {
       listen         80;
       server_name    www.-------------.com;
       return         301 https://www.-------------.com$request_uri;
}

server {

    listen 443 ssl;

    root /var/www/-------------.com/html;
    index index.html index.htm;

    ssl_certificate /etc/nginx/ssl/ssl-bundle.crt;
    ssl_certificate_key /etc/nginx/ssl/navarrarpg_com.key;

    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;

    ssl_prefer_server_ciphers on;
    ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS;

    server_name www.-------------.com;

    location / {
        try_files $uri $uri/ =404;
    }
}

Here are the four files I recieved:

  • AddTrustExternalCARoot.crt
  • COMODORSAAddTrustCA.crt
  • COMODORSADomainValidationSecureServerCA.crt
  • ————-_com.crt

Of course, I then used the command to bundle them all up nicely to get the bundled certificate plus the key using the other command.

Now, when I go to https://www.digicert.com/help/ and I type in my address… it says that I installed it correctly.

I checked out my cert installation to make sure I got the chain right:

  • Comodo RSA Certification Authority
    • Comodo RSA Domain Validation Secure Server CA
      • ————-.com

I used the following command:

cat -------------_com.crt COMODORSADomainValidationSecureServerCA.crt COMODORSAAddTrustCA.crt AddTrustExternalCARoot.crt > ssl-bundle.crt

from this guide: https://gist.github.com/bradmontgomery/6487319 to get the ssl bundle cert.

Why isn't my website showing up securely on my Android mobile but is on my desktop?

I get NET::ERR_CERT_AUTHORITY_INVALID error on my phone

Best Answer

One of the certs in the chain ending with AddTrust External CA Root (02faf3e291435468607857694df5e45b68851868) is missing from what your server provides.

Specifically the intermediate cert COMODO RSA Certification Authority (f5ad0bcc1ad56cd150725b1c866c30ad92ef21b0) is not included in what you serve.

What can also be seen is that the actual anchor is unnecessarily included instead. Maybe those two certificates were somehow switched up?

See eg SSL Labs Report

Related Topic