Ssl – GoDaddy SSL Certificate Issues With Safari

apache-2.2godaddysafarissl

We just got a new SSL certificate from GoDaddy. And, while all browsers are fine with the certificate, Safari gives the following error:

This certificate was signed by an
unknown authority.

We are using a chain file in the following config in Apache:

SSLEngine on
SSLCertificateFile /etc/apache2/ssl/godaddy.crt
SSLCertificateKeyFile /etc/apache2/ssl/godaddy.key
SSLCertificateChainFile /etc/apache2/ssl/gd_bundle2.crt

Looking around the web, it seems that others have experienced this issue as well (http://blog.boxedice.com/2009/05/11/godaddy-ssl-certificates-and-cannot-verify-identity-on-macsafari/) But no solution seems to fix the issue.

Does anyone know why this would be caused, or have experience with this happening, and how to fix it?

Best Answer

Verify that the correct intermediate certificates are being given out by the server at http://www.sslshopper.com/ssl-checker.html

As martona suggested, you may need to use a different bundle.

Verify the intermediate chain

As the error seems to indicate, there is something off about your intermediate certificate chain. You should check where you got your certificate from and that you got the correct intermediate bundle.

You should verify the "hash" and "issuer's hash" of every certificate in the chain with the openssl x509 -noout -hash and openssl x509 -noout -issuer_hash commands. Try this to get the issuer hash of your certificate:

cat /path/to/cert/mysite.com.cert | openssl x509 -noout -issuer_hash

Then try to find a certificate with this hash in the sf_bundle.crt file that you specified as SSLCertificateChainFile. You may have to extract the certificates (or just copy paste them to the command):

cat first_cert_from_sf_bundle.crt | openssl x509 -noout -hash

Check all of them. If none have this hash, then something is wrong right there. Keep doing these checks until you find a certificate which has the same -hash and -issuer_hash. This is your root certificate.

If something is missing, you can check the other intermediate files here https://certs.starfieldtech.com/anonymous/repository.seam. Download these and compare their -hash against the -issuer_hash where you got stuck.

If everything is okay, then ....

Clean up the intermediate chain

I have seen this also help when you get odd validation errors. Make sure that your intermediate chain lists only the required certificates and in the correct order (it is easier if it is in PEM format). In other words, if your chain is Your cert -> cert A -> cert B -> Starfield Root cert. Try appending these in this order (you can skip the first and last) so your intermediate chain looks something like this:

-----BEGIN CERTIFICATE-----
cert A
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
cert B
-----END CERTIFICATE-----

I personally like to keep all these certificates (personal certificate, followed by intermediate ones, followed by the root certificate) in the same file. Then I just specify this file as both the SSLCertificateFile and SSLCertificateChainFile.

Best Answer

Related Solutions

Ssl – Creating a single .pem file for web server SSL

Ssl – Starfield Wildcard SSL Certificate Not Trusted in All Browsers

Verify the intermediate chain

Clean up the intermediate chain

Related Topic