SSL certificate chain resolver

Re:SSL certificate chain resolver by praseodym on Sunday January 18, 2015 @08:28AM (#8907459)

One thing to note is that the Qualys SSL Labs test will complain if your server sends the (self-signed) root CA certificate, which will already be in the end-user's trust store. This uses unnecessary bandwidth for every TLS negotiation.

In many cases, the CA (or company you got your certificate from) will include this root cert in the chain. With most web servers it is perfectly fine to simply remove it, but I have seen applications where you cannot (VMware, which wants a complete chain ending with a self-signed cert) and where you'll have to ignore the SSL Labs warning.

[ Parent | on HN ]

Re:SSL certificate chain resolver by zakjan on Sunday January 18, 2015 @09:02AM (#8907526)

Yes, you are right, a root cert shouldn't be sent by server. My script doesn't append it to output, because (I hope) no intermediate certificate has AIA extension pointing to the root cert. If you find a counterexample, please file an issue, I will add a check.

[ Parent | on HN ]

Re:SSL certificate chain resolver by iancarroll on Sunday January 18, 2015 @10:37AM (#8907740)

A tangent of this is where you will get many irrelevant warnings due to compatibility chains. Comodo uses "Comodo <keytype> Certification Authority" but this has to be sent with your request as not all clients trust it, but they will trust the issuer.

[ Parent | on HN ]