sslhttpstls1.2

how is an SSL certificate chain bundle arranged?


I have 4 certificate files like this:

1.certum_certificate.crt
2.certum_certificate.pem
3.Intermediate_CA2.cer
4.Intermediate_CA.cer
5.Root_CA.cer

I put these files content by this order in a bundle file and I figured out that my SSL chain is incomplete.

How should I arrange them in bundle file?


Solution

  • In order to form the certificate chain, you need to know the trust order of your certificate in the chain.

    Just append the content of the individual certificate in a correct order to form a single certificate chain file. The order of the chain starts with your server certificate at the beginning, then follow by the intermediate certificate(s) and end up with the root certificate.

    For example, we have the following cert issuer chain

    Sample cert chain

    Then the content of the chain certificate file should be like this:

    -----BEGIN CERTIFICATE-----
    [Server Certificate]
    -----END CERTIFICATE-----
    -----BEGIN CERTIFICATE-----
    [Intermediate certificate L1]
    -----END CERTIFICATE-----
    -----BEGIN CERTIFICATE-----
    [Intermediate certificate L2]
    -----END CERTIFICATE-----
    -----BEGIN CERTIFICATE-----
    [Root Certificate]
    -----END CERTIFICATE-----
    

    Back to your question, I assume that your certificate issue chain order is

    certum_certificate <--(Issued by)-- Intermediate_CA <--(Issued by)-- Intermediate_CA2 <--(Issued by)-- Root_CA
    

    Then your order is

    (certum_certificate.crt content)
    (Intermediate_CA.cer content)
    (Intermediate_CA2.cer content)
    (Root_CA.cer content)
    

    What if I'm not so sure about my cert issue order?

    If your certs file names are all mix up and you're not sure about the issuing order, just simply use openssl to view the certificate to reveal the issuer of this certificate. For example

    openssl x509 -noout -text -in 'Entrust Certification Authority - L1K.crt'

    cert issuer sample

    We can infer that this Entrust Certification Authority - L1K cert is issued by Entrust Root Certification Authority - G2.