Most Common SSL Certificate Chain Issues & Their Solutions

Introduction

An SSL certificate is an important tool for website protection and the enforcement of cryptographic connections between the server and the client. However, SSL certificate chains may have certain issues that can lead to some troubles for site visitors starting from some annoyances to the impossibility of accessing the site at all.

This guide will look at the various SSL certificate chain implementation problems, along with the prescribed instructions to fix these problems.

From site owners to developers and even sys admins, it pays to know these by heart to prevent future website headaches or garner a solid remedy for existing ones.

Now that we know the issues that can arise with SSL certificate chains and the potential cost of not dealing with them correctly, it’s time to look at the most common problems and how you can address them.

Common SSL Certificate Chain Errors & Solutions

Incomplete Certificate Chain

Issue:

One of the most common SSL certificate chain problems is an incomplete chain. This occurs when intermediate certificates are missing from the server configuration.

Solution:

Obtain the full certificate chain from your CA.
Log in to your server via SSH.
Navigate to your SSL certificate directory (usually /etc/ssl/certs/).
Open your current certificate file using a text editor:

sudo nano your_domain_name.crt

Paste the intermediate certificates below your server certificate.
Save the file and exit the editor.
Restart your web server.

For Apache:

sudo service apache2 restart

For Nginx:

sudo service nginx restart

Incorrectly Ordered Certificate Chain

Issue:

Sometimes, the certificate chain is complete but in the wrong order, causing validation errors.

Solution:

Open your certificate file:
sudo nano /etc/ssl/certs/your_domain_name.crt
Ensure the order is correct.
Your domain’s certificate should be at the top.
Intermediate certificates should follow in order, from the one that signed your certificate to the one closest to the root certificate.
The root certificate should not be included.
Save the file and restart your web server.

Expired Intermediate Certificates

Issue:

Even if your domain certificate is valid, expired intermediate certificates can cause chain validation failures.

Solution:

Check the expiration dates of all certificates in your chain:

openssl verify -verbose -CAfile /path/to/root_cert.pem /path/to/your_cert_chain.pem

If any intermediate certificates have expired:

Contact your CA for updated intermediate certificates.
Replace the expired certificates in your chain.
Restart your web server.

Also Read: How to Resolve ERROR_SSL_UNEXPECTED_MESSAGE?

Self-Signed Certificates in the Chain

Issue:

Including self-signed certificates in your chain can cause validation errors and security warnings.

Solution:

Remove any self-signed certificates from your chain.
Ensure you’re using certificates issued by a trusted CA.
If you need a self-signed certificate for testing:
- Create a separate configuration for development environments.
- Never use self-signed certificates in production.

Also Read: How to Resolve the “Self-Signed Certificate in Certificate Chain” Error?

Missing Root Certificate

Issue:

Some servers might not include root certificates in their trust stores, leading to validation failures.

Solution:

Check if the root certificate is missing using the command:

openssl s_client -connect your_domain.com:443 -showcerts

If you don’t have any, download the root certificate from your CA.
Add it to your server’s trust store:

For Ubuntu/Debian:

sudo cp root_cert.crt /usr/local/share/ca-certificates/
sudo update-ca-certificates

For CentOS/RHEL:

sudo cp root_cert.crt /etc/pki/ca-trust/source/anchors/
sudo update-ca-trust extract

Mismatched Server Name Indication (SNI)

Issue:

When hosting multiple SSL certificates on a single IP address, SNI mismatches can occur.

Solution:

Ensure your server software supports SNI (most modern servers do).
Configure your virtual hosts correctly:

For Apache:

<VirtualHost *:443>
    ServerName your_domain.com
    SSLEngine on
    SSLCertificateFile /path/to/your_domain_cert.pem
    SSLCertificateKeyFile /path/to/your_domain_key.pem
    SSLCertificateChainFile /path/to/your_chain_file.pem
</VirtualHost>

For Nginx:

server {
    listen 443 ssl;
    server_name your_domain.com;
    ssl_certificate /path/to/your_domain_cert.pem;
    ssl_certificate_key /path/to/your_domain_key.pem;
}

Restart your web server after making changes.

Certificate and Private Key Mismatch

Issue:

If the private key doesn’t match the certificate, SSL handshakes will fail.

Solution:

Check if the certificate and key match:

openssl x509 -noout -modulus -in your_certificate.pem | openssl md5
openssl rsa -noout -modulus -in your_private_key.pem | openssl md5

If the outputs don’t match, you’ll need to:
- Generate a new Certificate Signing Request (CSR) with the correct private key.
- Obtain a new certificate from your CA using this CSR.
- Install the new certificate and ensure it matches the private key.

Insufficient Cipher Suite Support

Issue:

Outdated server configurations might not support modern cipher suites, causing connection issues for some clients.

Solution:

Check your current cipher suite support:

nmap --script ssl-enum-ciphers -p 443 your_domain.com

Update your server configuration to include strong, modern cipher suites:

For Apache:

SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH

Restart your web server to apply the changes.

Also Read: How to Fix ERR_SSL_VERSION_OR_CIPHER_MISMATCH Error?

Incorrect File Permissions

Issue:

Incorrect file permissions can prevent the web server from reading certificate files.

Solution:

Check current file permissions:

ls -l /path/to/your/ssl/files

Set correct permissions:

sudo chmod 644 your_certificate.pem
sudo chmod 600 your_private_key.pem

Ensure the web server user has read access to the certificate files.
Restart your web server.

Protocol Version Mismatch

Issue:

Supporting outdated SSL/TLS versions can lead to security vulnerabilities.

Solution:

Check supported protocols:

nmap --script ssl-enum-ciphers -p 443 your_domain.com

Update your server configuration to disable old protocols:

For Apache:

SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1

For Nginx:

ssl_protocols TLSv1.2 TLSv1.3;

Restart your web server.

Certificate Revocation Issues

Issue:

Using a revoked certificate can cause security warnings and connection failures.

Solution:

Check if your certificate is revoked:

openssl ocsp -issuer /path/to/issuer_cert.pem -cert /path/to/your_cert.pem -text -url http://ocsp.your-ca.com

If revoked, contact your CA to understand the reason and potentially get a new certificate.
Implement OCSP stapling to improve performance:

For Apache:

SSLUseStapling on
SSLStaplingCache "shmcb:logs/stapling-cache(150000)"

For Nginx:

ssl_stapling on;
ssl_stapling_verify on;

Clock Synchronization Issues

Issue:

Server clocks that are significantly out of sync can cause certificate validation failures.

Solution:

Check your server’s current time:

If incorrect, update it:

sudo ntpdate pool.ntp.org

Configure NTP for ongoing synchronization:

sudo apt-get install ntp
sudo systemctl enable ntp
sudo systemctl start ntp

Verify NTP is working correctly:

ntpq -p

Consider setting up multiple NTP servers for redundancy:

server 0.pool.ntp.org
server 1.pool.ntp.org
server 2.pool.ntp.org
server 3.pool.ntp.org

Implement a monitoring solution to alert you if your server’s time drifts significantly.
For virtual machines, ensure the hypervisor’s time is correctly synchronized with NTP as well.

Mixed Content Warnings

Issue:

Even with a valid SSL certificate, loading HTTP resources on an HTTPS page can trigger mixed content warnings.

Solution:

Identify mixed content:
Use browser developer tools to find HTTP resources.
Run a content scan using online tools like WhyNoPadlock or SSL Check.
Replace “http://” with “https://” for all resources.
Use protocol-relative URLs (e.g., “//example.com/resource”) when appropriate.
Implement Content Security Policy (CSP) headers:

For Apache, add to your .htaccess file:

Header set Content-Security-Policy "upgrade-insecure-requests

For Nginx, add to your server block:

add_header Content-Security-Policy "upgrade-insecure-requests";

Use automatic HTTPS rewrites for external resources when possible.
Update any hardcoded internal links to use HTTPS.
Check and update any APIs or third-party services to ensure they support HTTPS.
Implement HSTS (HTTP Strict Transport Security) to force HTTPS connections:

For Apache:

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"

For Nginx:

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

Conclusion

It is immensely important to solve the SSL certificate chain issues to have a secure and trustworthy website. Thus, by applying the solutions offered in this guide, you can address typical issues connected with organizing the SSL and guarantee that it will remain efficient and flawless.

Azure Key Vault OV Code Signing

Azure Key Vault EV Code Signing

EV Code Signing

Introduction

Common SSL Certificate Chain Errors & Solutions

Incomplete Certificate Chain

Issue:

Solution:

Incorrectly Ordered Certificate Chain

Issue:

Solution:

Expired Intermediate Certificates

Issue:

Solution:

Self-Signed Certificates in the Chain

Issue:

Solution:

Missing Root Certificate

Issue:

Solution:

Mismatched Server Name Indication (SNI)

Issue:

Solution:

Certificate and Private Key Mismatch

Issue:

Solution:

Insufficient Cipher Suite Support

Issue:

Solution:

Incorrect File Permissions

Issue:

Solution:

Protocol Version Mismatch

Issue:

Solution:

Certificate Revocation Issues

Issue:

Solution:

Clock Synchronization Issues

Issue:

Solution:

Mixed Content Warnings

Issue:

Solution:

Conclusion

Janki Mehta