Incomplete cert chain for PositiveSSL certs
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	revi
	Feb 4 2018, 10:50

Description

Examples: 1, 2

Both are issued by "COMODO RSA Domain Validation Secure Server CA" with organizationalUnitName "PositiveSSL Domain Control Verified" and are generating "Incomplete chain" error according to SSL Labs.

We are sending "COMODO RSA Certification Authority", but not "COMODO RSA Domain Validation Secure Server CA", which is http://crt.comodoca.com/COMODORSADomainValidationSecureServerCA.crt

I think we only have PositiveSSL DV certs ([Citation needed]), so maybe rename Comodo to PositiveSSLDV with the correct CA cert? (There are OV CA, EV, and Comodo ECC CA. ~~What a mess~~)

Revisions and Commits

rSSL SSL configuration
	rSSLf052c183ae3f Replace reviwiki.info.crt and add PositiveSSLDV CA

Related Objects

Mentioned Here: T2691: Puppet errors on servers caused by permission changes on puppet1 (puppet-users)

Event Timeline

revi created this task.Feb 4 2018, 10:50

Herald added subscribers: Southparkfan, PokestarFan, Brynda1231 and 2 others. · View Herald TranscriptFeb 4 2018, 10:50

And verified these two certs are only Comodo certs, using phab.

revi triaged this task as Normal priority.Feb 4 2018, 10:56

@John any ideas about why there's this incomplete chain error?

revi moved this task from Incoming to TLS on the revi board.Feb 4 2018, 11:41

certificate/reviwiki.info.crt(the old one) has correct leaf and intermediate (hereinafter int.) certificates by LE, and ssllabs correctly recognizes it.

However for certificate/private.revi.wiki.crt, it has correct leaf and int. cert in the repo, but ssllabs is not recognizing the int.

This is really... weird. I'll try bundling int. in CA folder as "PositiveSSLDV" and test it on reviwiki.info (which I have a new cert with same CA)

revi added a commit: rSSLf052c183ae3f: Replace reviwiki.info.crt and add PositiveSSLDV CA.Feb 4 2018, 12:54

This was somewhat blocked by T2691: Puppet errors on servers caused by permission changes on puppet1 (puppet-users), and after it was fixed, I realized it didn’t fix it, I made it worse. (It’s now not sending int.) Will have to rollback to Comodo tomorrow.