How to Resolve the “Self-Signed Certificate in Certificate Chain” Error?

What is a Self-Signed Certificate?

A self-signed certificate is an SSL/TLS certificate that contains a signature of the entity that issued the certificate and did not receive it from an authoritative Certificate Authority (CA).

Thus, while CA-signed certificates are only issued after validation by a third party, self-signed certificates are generated and validated by the owner free of charge and almost instantly.

Also Read: Self-Signed SSL Certificate Vs Trusted CA Certificate – Difference Explained

This kind of certificate is mainly preferred in development environments, for internal network applications or applications that are developed for personal use and hence does not require the certificate to be trusted by the public.

Self-generated certificates are inexpensive and can be created on the spot, but they are not recognized by either the browser or the operating system as reliable.

This often causes pop-ups that a website using such a certificate is insecure, or prevents users from accessing it altogether.

The absence of such trust and validation is a security concern, therefore, self-signed certificates cannot be used in production systems where secure and trusted form of communication is mandatory.

Nevertheless, they are useful for intranet or other low-risk contexts, where outside trust verification is not desirable.

Causes of “Self-Signed Certificate in Certificate Chain” Error

Inclusion of a Self-Signed Certificate in the Chain

As the name suggests, these certificates are issued by the subject itself and are signed by the same subject, thus having no third-party validation. This is especially the case when such a certificate is part of a chain; clients do not accept it unless it is trusted.

Also Read: How to Create a Self-Signed SSL Certificate in Powershell?

It is a common problem that from the server side while misconfiguration the things, it adds its own self-signed certificate in the certificate chain which it forwards to the clients.

This is quite acceptable during the stages of development or testing internally, but it is disastrous in the production system.

Misconfigured Intermediate Certificates

SSL/TLS certificates must be chained, using one or more intermediate certificates that link the server’s certificate to a root certificate that is trusted in the client or browser.

If these intermediates are misconfigured or included incorrectly in the chain, the client will not be able to validate the chain as it will believe it to be invalid.

Such a misconfiguration can arise from improper configuration of the server or from an improper installation of the certificate by the CA.

Missing Intermediate Certificates

There could also be no intermediate certificates in between for a client to accept the server’s certificate, one has to get a certificate chain that ends with a trusted CA certificate.

If these intermediates are missing the client cannot complete a validation chain, something that creates trust problems.

Also Read: How to Setup a Self-Signed Certificate in IIS?

This situation commonly happens when the server administrator fails to install all the intermediate certificates that are required during the SSL/TLS configuration of the server.

Expired Certificates

Certificates have a lifetime, this means that certificates can expire and if the certificate is expired, it is not trusted any longer.

This means that as soon as any of the chain certificates such as the server certificate, an intermediate certificate, or the root certificate expires, the overall chain is null and void.

Also Read: Buy or Renew SSL/TLS Certificate Starts @ $3.99/Yr

Users will notice the invalidation and mark the chain as untoward, which causes distress. Proper management of certificates also requires frequent updating and extending of certificates to avoid such challenges.

Incorrectly Issued Certificates

Make sure that no self signed certificate is being unnecessarily sent along in the certificate chain. Scan your server for any other configurations of the self-signed certificate and delete any of them which are not part of the public chain.

This cleaning process is very useful in ensuring that the presented certificate chain is valid and trusted.

Steps to Fix “Self-Signed Certificate in Certificate Chain” Error

Verify the Certificate Chain

Begin with the server configuration to confirm whether all the necessary intermediate certificates required in the full certificate chain are correctly installed.

This can be accomplished by running an SSL Test through SSL Labs, which will evaluate the certificate chain on your server and let you know if there are problems.

Obtain and Install the Correct Intermediate Certificates

The error can be corrected by taking the correct intermediate certificates from the CA that issued your server certificate.

From these, generate a file that contains your server certificate and the intermediate certificates in the sequence:

To do that, you must update your server configuration to utilize this single certificate file. Apache users will need to use SSLCertificateFile and SSLCertificateChainFile, and Nginx users will need to use the ssl_certificate and ssl_certificate_key directives.

Replace Self-Signed Certificates with Trusted CA Certificates

If you have issued your own certificate, it would be wise to change it to a certificate issued by a recognized CA. You can buy one from any CA and then install it on the server as per the instructions of the CA you have used. This replacement helps browsers and operating systems recognize the certificate chain, which helps remove the error.

Remove Unnecessary Self-Signed Certificates from the Chain

Make sure that there are no unnecessary self-signed certificates that are added to the certificate chain.

If there are additional self signed certificates in the chain then review your server settings to identify them and delete them if they are not part of the public chain. This cleaning helps in avoiding having a non valid and trusted certificate chain.

Update Expired Certificates

Compromised trusted certificates within the chain may hinder validation. To do so, visit your CA or reseller’s website and renew any certificates that may have already expired; then upload the newly provided certificates to your server.

Maintaining all certificates updated keeps the chain valid and trusted so it is of utility to keep all certificates valid.

Ensure Client Trust Stores are Updated

Certain updates bring updated root certificate stores to the clients (browsers, operating systems), so check that these are installed.

Also Read: What is a Root Certificate and How to Download It?

In some circumstances, the CA’s root certificate may be required to be installed into the trusted store of the client, though this may be relevant in corporate or internal networks. Updating the client trust stores is beneficial in avoiding trust problems.

Test the Configuration

As soon as you have made the modifications, try the configuration to make sure the problem is fixed.

The fingerprint may be verified on the terminal using openssl which will verify the certificate chain through openssl s_client -connect yourdomain.com:443 -showcerts.

Furthermore, open your site via multiple browsers to ensure that the mentioned error is no longer included.

Document and Automate Certificate Management

To ensure that you have documented relevant details for future reference in case the problem re-emerges, document the steps you have taken to rectify the problem.

In this regard, it is recommended to use tools like Certbot to manage certificates acquisition and renewal, as well as the installation of up-to-date certificates.

By automating SSL/TLS status monitoring, an organization is able to effectively manage its certificate configuration without the need for frequent intercessions, and avoid certificate associated issues.

Conclusion

Secure your connection with CheapSSLweb providing the best SSL certificates at the lowest costs. This is because trusted security is achieved, installation is simple and does not take a lot of time, while the technical support is available throughout – be it at night or during the day.