SSL Certificate order

[Cheekian Tan]

Hi Fred,

I purchased the SSL certificate from Comodo Certification Authority. It contains four files:

1. classroom_iaapathway_com.crt
2. AddTrustExternalCARoot.crt
3. SectigoRSADomainValidationSecureServerCA.crt
4. USERTrustRSAAddTrustCA.crt

In this command below, I entered the content of "classroom_iaapathway_com.crt" as 1 and content of "SectigoRSADomainValidationSecureServerCA.crt" and "USERTrustRSAAddTrustCA.crt" as 2.

# cat >/etc/nginx/ssl/classroom.mydomain.com.crt <<'END'
Paste (in order) the contents of the following files:
  1. The signed certificate from the CA
  2. In order, each intermediate certificate provided by the CA (but do not include the root).
END

Am I doing this right?

Thanks,
Cheekian

[Sven Brozio]

Mostly right, but why wouldn't you include the root certificate? It's crucial for OCSP stapling which is a must have if you want maximum security (and the ratings that come with it).

What you are doing is basically creating a chain certificate, beginning with your server certificate all the way to the root, all certificates validating the next one in the chain.

See: https://www.samkear.com/security/install-comodo-positive-ssl-certificate-nginx

Or: https://support.comodo.com/index.php?/Knowledgebase/Article/View/1145/1/how-do-i-make-my-own-bundle-file-from-crt-files

[Cheekian Tan]

Hi Sven,

Thanks for the reply. It says "(but do not include the root)" in the docs. That's why I didn't include the root file. Should include that then?




Regards,

Cheekian


[Sven Brozio]

Which docs are you referring to? The BBB docs? Do you have a link?

SSL usually has nothing to do with the client software you use, it takes place at the connection level. Usually it's best to follow the instructions of the certificate issuer, since changes are frequent and when it comes to security, you want to be up to date.

Just try it, if it works check your site with the SSL-test:https://www.ssllabs.com/ssltest/

This checks your site for vulnerabilities.

[Calvin Walton]

On Tue, 2019-10-01 at 00:44 -0700, Cheekian Tan wrote:
> Hi Sven,
>
> Thanks for the reply. It says "(but do not include the root)" in the
> docs.
> That's why I didn't include the root file. Should include that then?

The root certificate is the certificate that the web browser already
has in its local certificate store. The web browser will ignore it if
it's sent as part of the certificate chain, and will validate using the
local copy of the root certificate instead.

So including the root certificate in the certificate chain sent by the
server is unnecessary, and the extra size of the ssl handshake might
slow down connections a bit.

Note that OSCP stapling does not require the root certificate to be
installed on the server - it only needs the intermediate certificates.

--
Calvin Walton <calvin...@kepstin.ca>