Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I just got an message SSL Certificate Chain Not Sorted when I scanned my server configuration...I am not sure how to order or sort the certificates.

I have a SSL certificate and intermediate certificates as well. And, I have configured them in apache. But not sure what is the right order or how to sort these certificates.

share|improve this question

migrated from security.stackexchange.com Mar 26 '12 at 17:22

This question came from our site for Information security professionals.

    
I'd be interested in reproducing the error if anyone can provide details on how this could happen. –  makerofthings7 Mar 26 '12 at 12:45
    
@makerofthings7: to reproduce this is fairly easy if you have a certificate with a intermediate CA cert in the chain on an Apache Httpd server. Check the files where it's configured SSLCertificateChainFile or SSLCertificateFile and swap the order of the PEM blocks. –  Bruno May 4 '12 at 23:18

1 Answer 1

The certificate chain presented by the server should be sorted according to the TLS Specification:

certificate_list

This is a sequence (chain) of X.509v3 certificates. The sender's certificate must come first in the list. Each following certificate must directly certify the one preceding it. Because certificate validation requires that root keys be distributed independently, the self-signed certificate that specifies the root certificate authority may optionally be omitted from the chain, under the assumption that the remote end must already possess it in order to validate it in any case.

You can check the list that is presented using openssl s_client -connect your.host.name:443, for example. Taking www.github.com as an example, you should get something like this:

Certificate chain
 0 s:/O=*.github.com/OU=Domain Control Validated/CN=*.github.com
   i:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certificates.godaddy.com/repository/CN=Go Daddy Secure Certification Authority/serialNumber=07969287
 1 s:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certificates.godaddy.com/repository/CN=Go Daddy Secure Certification Authority/serialNumber=07969287
   i:/C=US/O=The Go Daddy Group, Inc./OU=Go Daddy Class 2 Certification Authority
 2 s:/C=US/O=The Go Daddy Group, Inc./OU=Go Daddy Class 2 Certification Authority
   i:/L=ValiCert Validation Network/O=ValiCert, Inc./OU=ValiCert Class 2 Policy Validation Authority/CN=http://www.valicert.com//emailAddress=info@valicert.com
 3 s:/L=ValiCert Validation Network/O=ValiCert, Inc./OU=ValiCert Class 2 Policy Validation Authority/CN=http://www.valicert.com//emailAddress=info@valicert.com
   i:/L=ValiCert Validation Network/O=ValiCert, Inc./OU=ValiCert Class 2 Policy Validation Authority/CN=http://www.valicert.com//emailAddress=info@valicert.com

The issuer of a certificate in the chain should be the subject of the next certificate.

The order presented by the server matches the order in which you've put the certificates in PEM format in the Apache Httpd configuration files.

Either you chain them all in the file referred to by SSLCertificateFile, or you only put your server certificate there and put the rest of the chain, in order, in a separate file referred to by SSLCertificateChainFile.

To check which PEM fragment (between --... BEGIN/END ...--), copy them in separate .pem file and check what your favourite PEM viewer says, or paste the fragment in the standard input of openssl x509 -text -noout.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.