Bug 200170 - SSL Certificate does not have Intermediate CAs imported
Summary: SSL Certificate does not have Intermediate CAs imported
Status: Closed FIXED
Alias: None
Product: Services
Classification: Unclassified
Component: Forums (show other bugs)
Version: unspecified
Hardware: Any Any
: --- Affects Many People
Assignee: Forum Adminstrators
URL: https://forums.freebsd.org/
Keywords:
Depends on:
Blocks:
 
Reported: 2015-05-13 14:09 UTC by James Elstone
Modified: 2015-05-13 20:15 UTC (History)
1 user (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description James Elstone 2015-05-13 14:09:33 UTC 
When browsing to https://forums.freebsd.org/ on certain browsers / platforms the Intermediate Certificate Authorities cannot be verified.  This varies between browsers and platform the website is being viewed from.

E.G.
 - On FreeBSD v10.1-p9 (using latest Midori and NSS), the signing certificate authority is not known (can't view),
 - On Android (4.4.2) I get NET::ERR_CERT_AUTHORITY_INVALID, (proceeds with error) and
 - On MS Windows (with recent updates applied) the keychain is seen as valid.

See output from here:
https://www.ssllabs.com/ssltest/analyze.html?d=forums.freebsd.org&hideResults=on

Also from SSLyze:
  * Certificate - Trust:
      Hostname Validation:               OK - Subject Alternative Name matches
      "Mozilla NSS - 08/2014" CA Store:  FAILED - Certificate is NOT Trusted: unable to get local issuer certificate
      "Microsoft - 08/2014" CA Store:    FAILED - Certificate is NOT Trusted: unable to get local issuer certificate
      "Apple - OS X 10.9.4" CA Store:    FAILED - Certificate is NOT Trusted: unable to get local issuer certificate
      "Java 6 - Update 65" CA Store:     FAILED - Certificate is NOT Trusted: unable to get local issuer certificate
      Certificate Chain Received:        ['forums.freebsd.org', 'Gandi Standard SSL CA']

(Thanks to Winfried Neessen for the above SSLyze output)

This is potentially due to a known issue with Gandi SSL services, see here:
http://wiki.gandi.net/en/ssl/intermediate

As of right now, I cannot browse to https://forums.freebsd.org/ from a FreeBSD platform.

Kr,

James.
Comment 1 Brad Davis freebsd_committer freebsd_triage 2015-05-13 14:22:14 UTC 
Thanks for reporting, I will check into this right now!
Comment 2 James Elstone 2015-05-13 14:27:06 UTC 
(In reply to Brad Davis from comment #1)
Thanks!
Comment 3 Brad Davis freebsd_committer freebsd_triage 2015-05-13 14:35:15 UTC 
Ok, I have upgraded the intermediate cert. SSLLabs shows it is better, but please test again.
Comment 4 James Elstone 2015-05-13 15:32:55 UTC 
Thanks for doing this - it seems OK now!!

Have tested on:
- FreeBSD v10.1-p9 with latest midori and nss root CA ports and works OK.
- Android v4.4.2 with latest Google Chrome and works OK.

(Latest as of 16:32 today)