Ssl – Should I need to provide a root certificate when setting SSL cert on nginx

certificate-authorityhttpsSecuritysslssl-certificate

In Qualys SSL test always warn me that the root certificate is an extra download and can be safely removed.

However, from Comodo website, their guide on installing cert on nginx is

NGINX Needed for this task: * PEM encoded certificates (Root, Intermediate(s) and 
Domain/Device) COMBINE (CONCATENATE) MULTIPLE CERTIFICATES INTO ONE FILE

You know, they are a CA and be the authentic answser. So, which one I should trust?

Updates: I also gather more advises from other CA as well

Suggest adding the root cert

Suggest no need the root cert

So so confusing?

Best Answer

Both, Qualys SSL test and Comodo are correct. Comodo is correct from the server-side code perspective. Nginx should trust certificates it uses.

On the other hand, Qualys SSL test is correct from network protocol perspective. During SSL negotiation, server must send its own SSL certificate and all intermediate CA certificates except root certificate. A reference from RFC 5246 §7.4.2:

certificate_list This is a sequence (chain) of certificates. The sender's certificate MUST come first in the list. Each following certificate MUST directly certify the one preceding it. Because certificate validation requires that root keys be distributed independently, the self-signed certificate that specifies the root certificate authority MAY be omitted from the chain, under the assumption that the remote end must already possess it in order to validate it in any case.

Related Topic