CODEWITHSUNDEEP
linuxssl
user6335451
user6335451

Reputation:

Certificate authority invalid

We recently renewed our certs for our vhost domains: genietvanhetleven.org newportandbeyond.org privustech.com truthcourage.org

Chromium reports ` NET::ERR_CERT_AUTHORITY_INVALID

Firefox reports ` SEC_ERROR_REVOKED_CERTIFICATE

The sites open just fine in Konqueror.

  1. I cleared the cache in Chromium and Firefox and shut down for the night. After a restart they all are now working under http but https is struck out.

  2. We have Used Qualys: Qualys shows For privustech.com: Certificate #2 No SNI Common names genietvanhetleven.org MISMATCH Trusted No NOT TRUSTED ` Path #2: Not trusted (invalid certificate:

Where is this second cert coming from????

This and all the others get an "A" rating without any other errors.

=====

  1. This may be due to CA cert issues. However, we have: • Checked the CA certs, they are valid • Checked file encoding, they are valid (us-ascii) ` • Redownloaded and installed the site and intermediate chain certificates.

  2. We have checked the key-cert pairs, they are valid: openssl x509 -in _start.crt -text -noout

  3. We have checked the chains, they are valid: # openssl verify -verbose -CAfile <vhost>_start_chain.crt _start.crt _start.crt: OK

  4. We have checked the validity dates, they are valid. # openssl x509 -startdate -enddate -noout -in <vhost>_start.crt notBefore=Jan 28 21:17:02 2017 GMT ` notAfter=Jan 28 21:17:02 2020 GMT

  5. We have checked configuration files. they are valid: All have the same ServerName privustech.com:993 ServerAdmin [email protected] SSLCACertificatePath /etc/ssl/certs SSLCACertificateFile ` /etc/ssl/certs/StartCom_Certification_Authority.pem

  6. We have checked error logs: X509_check_private_key:key values mismatch But they do match.

So quite a mess. It was working fine until the OLD certs,expired, but we have installed the NEW certs, intermediate and CA certs and cleared the cache, so why is it addressing the old certs???

Upvotes: 2

Views: 1374

Answers (1)

Steffen Ullrich
Steffen Ullrich

Reputation: 123471

These are sites which use StartCom certificates. Because of cheating attempts StartCom is no longer trusted by major browsers, at least Chrome and Firefox. For more details see

Upvotes: 1

Related Questions