Incorrect SSL cert chain build order used/required by nginx 1.3.8 ?

[Axel]

Hi,

I use portecle ( http://portecle.sourceforge.net/ ) to examine ssl 
certificates.

Rgds, Axel


Am 01.11.2012 00:47, schrieb chiterri at operamail.com:
> I'm running nginx/1.3.8 on linux/64.
>
> I'm installing a commercial cert in nginx (Comodo Essential SSL).
>
> When I build the SSL chain in order per instructions from Comodo (Root
> -> Intermediate(s)
>
> 	https://comodosslstore.com/blog/how-do-i-make-my-own-bundle-file-from-crt-files.html
>
> I do
>
> 	cat AddTrustExternalCARoot.crt >  my.domain.com.CHAIN.crt
> 	cat UTNAddTrustSGCCA.crt       >> my.domain.com.CHAIN.crt
> 	cat ComodoUTNSGCCA.crt         >> my.domain.com.CHAIN.crt
> 	cat EssentialSSLCA_2.crt       >> my.domain.com.CHAIN.crt
> 	cat STAR_domain.com.crt        >> my.domain.com.CHAIN.crt
>
>
> If use this CHAIN'd cert in my nginx conf,
>
> 	ssl                       on;
> 	ssl_verify_client         off;
> 	ssl_certificate           "/path/to/my.domain.com.CHAIN.crt";
> 	ssl_certificate_key       "/path/to/my.domain.com.key";
>
> and start nginx, it fails,
>
> 	==> error.log <==
> 	2012/10/31 16:36:44 [emerg] 8666#0:
> 	SSL_CTX_use_PrivateKey_file("/path/to/my.domain.com.key") failed
> 	(SSL: error:0B080074:x509 certificate
> 	routines:X509_check_private_key:key values mismatch)
>
> If I simply switch the cert CHAIN build order, so the personal site crt
> is *first* to,
>
> +       cat STAR_domain.com.crt        >  my.domain.com.CHAIN.crt
> -       cat AddTrustExternalCARoot.crt >  my.domain.com.CHAIN.crt
> +       cat AddTrustExternalCARoot.crt >> my.domain.com.CHAIN.crt
> 	cat UTNAddTrustSGCCA.crt       >> my.domain.com.CHAIN.crt
> 	cat ComodoUTNSGCCA.crt         >> my.domain.com.CHAIN.crt
> 	cat EssentialSSLCA_2.crt       >> my.domain.com.CHAIN.crt
> -       cat STAR_domain.com.crt        >> my.domain.com.CHAIN.crt
>
> then start nginx, it starts correctly, with no error.  The site's
> accessible from most locations.
>
> But a check with
>
> 	https://www.ssllabs.com/ssltest/index.html
>
> returns/reports
>
> 	"Chain issues   Incorrect order"
>
> I'd like to get nginx to accept/use the correct/instructed CHAIN order
> so that it starts-up correctly AND is reported 'correct order; by
> testing sites.
>
> Is this is a config issue on my end -- either nginx or the cert build?
> Or a bug?
>
> _______________________________________________
> nginx mailing list
> nginx at nginx.org
> http://mailman.nginx.org/mailman/listinfo/nginx
>