letsencrypt Chain issues: Incorrect order, Extra certs

Submitted by stretch on Thu, 11/10/2016 - 09:46

Hi, I'm using latest virtualmin with Let's encrypt certificates. Although everything works well on most devices the certificate Chain has issues: Chain issues: Incorrect order, Extra certs which lead to site unavailability on some android devices due to err_cert_authority_invalid error.

BTW virtualmin.com has correct certificate chain https://www.ssllabs.com/ssltest/analyze.html?d=virtualmin.com&hideResult... and as you can see there's only one Let's Encrypt Authority X3 in your setup, but in my setup which was automatically configured by virtualmin there are Let's Encrypt Authority X3 and Let's Encrypt Authority X1 , I beleive the Let's Encrypt Authority X1 certificate is not required but is concatenated with X3 certificate into letsencrypt-lib.pl into one cert file.

Status: 
Active

Comments

Submitted by stretch on Fri, 11/11/2016 - 04:44

any comments on this? When delete the Let's Encrypt Authority X1 from the .cert file manually is solves the issue.

Submitted by JamieCameron on Fri, 11/11/2016 - 20:52

Ok, the next release of Webmin will include only the X3 CA file.

Submitted by JamieCameron on Fri, 11/11/2016 - 20:53

Status: Active » Fixed

Submitted by stretch on Sun, 05/07/2017 - 20:59

Hi Jamie, can you please concatenate ssl.ca and ssl.cert into fullchain.pem when generating lets encrypt certificates? Also Nginx should be pointed to this certificate by default. It would make a full certificate chain available and will give a A+ rating for SSL support on SSL labs(without this is only B grade). cat ssl.ca ssl.cert > fullchain.pem

Submitted by stretch on Sun, 05/07/2017 - 20:58

Status: Closed (fixed) » Active

Submitted by JamieCameron on Tue, 05/09/2017 - 01:11

That should already be happening when using Nginx.

Submitted by stretch on Tue, 05/09/2017 - 08:46

It happens on one server with latest webmin, but doesn't on another which also has latest webmin. Can you advise me what to check that it doesn't happen there?

Submitted by JamieCameron on Tue, 05/09/2017 - 12:20

Check which version of the Nginx and Nginx SSL plugins you're running - this is shown at System Setting -> Features and Plugins.