Windows – How to deploy new CA certificate to Firefox installs

I had the same problem - bought a basic SSL certificate (from Network Solutions), installed it under nginx, and it worked fine in both Opera and IE - but not Firefox 3.6.12. This is how I solved the problem. Note that I have root/shell access to my VPS, I don't know if you do (at least this might point your providers in the right direction).

The first step in finding the solution was using Qualys (as per this other answer). It told me that the chain was incomplete.

Second, I used OpenSSL for testing/debugging. Assuming you have shell access, you can do the command (q or CTRL-C to disconnect):

openssl s_client -connect mysite.com:443

and you will probably see the error "unable to get local issuer certificate". This is also a way to test when it's working, in the shell, without running Firefox.

SSL Certificate Chains

Some browsers may complain about a certificate signed by a well-known certificate authority, while other browsers may accept the certificate without issues. This occurs because the issuing authority has signed the server certificate using an intermediate certificate that is not present in the certificate base of well-known trusted certificate authorities which is distributed with a particular browser. In this case the authority provides a bundle of chained certificates which should be concatenated to the signed server certificate. The server certificate must appear before the chained certificates in the combined file

Nginx configuration

In my case, I had gotten three files from Network Solutions - mysite.com.crt, AddTrustExternalCARoot.crt, and NetworkSolutionsDVServerCA.crt. There was no bundle file, but it's possible to create one from the other certificates. After some trial-and-error, I found what I needed was:

$ cat mysite.com.crt NetworkSolutionsDVServerCA.crt > mysite.com.chain.crt

The final step was to reconfigure my nginx server with the new file:

server {
    listen       443;
    ssl          on;
    ssl_certificate        /etc/ssl/certs/mysite.com.chain.crt;
    ssl_certificate_key    /etc/ssl/private/mysite.com.key;

    server_name  mysite.com;
    # and so on
}

After getting the right certificates in the bundle, and restarting nginx, openssl reported no errors, Firefox got the page with no problem, and Qualys reported the chain was valid.

Apache configuration

Since you're running Apache, then you (or your providers) need to configure it for SSL with the correct file locations, one of which is the missing intermediate chain file:

<VirtualHost 192.168.0.1:443>
    DocumentRoot /var/www/html2
    ServerName www.yourdomain.com
    SSLEngine on
    SSLCertificateFile /path/to/your_domain_name.crt
    SSLCertificateKeyFile /path/to/your_private.key
    SSLCertificateChainFile /path/to/DigiCertCA.crt
</VirtualHost>

Two ways to set this up on Chrome:

1. Set MCX preferences using the Workgroup Manager to configure the RestoreOnStartupURLs policy. See http://www.chromium.org/administrators/policy-list-3#RestoreOnStartup.
2. Set a master preferences file with the desired homepage/startup URLs, and it will be automatically imported for new chrome profiles.

More details on both solution at http://www.chromium.org/administrators.