You are viewing a plain text version of this content. The canonical link for it is here.
Posted to bugs@httpd.apache.org by bu...@apache.org on 2021/09/23 08:39:08 UTC

[Bug 65594] New: Incorrect certificate chain sent to client

https://bz.apache.org/bugzilla/show_bug.cgi?id=65594

            Bug ID: 65594
           Summary: Incorrect certificate chain sent to client
           Product: Apache httpd-2
           Version: 2.4.37
          Hardware: All
                OS: All
            Status: NEW
          Severity: major
          Priority: P2
         Component: mod_ssl
          Assignee: bugs@httpd.apache.org
          Reporter: marc.stern@approach.be
  Target Milestone: ---

When using SSLCertificateChainFile with certificates belonging to different
chains, httpd sends all certificates to the client instead of only the chain.
Although most browsers accept it, some clients refuse this (like Facebook and
Linkedin preview clients).
Only certificates belonging to the current chain should be sent.

-- 
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org

[Bug 65594] Incorrect certificate chain sent to client

Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=65594

Ruediger Pluem <rp...@apache.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |NEEDINFO

--- Comment #1 from Ruediger Pluem <rp...@apache.org> ---
Can you give an example configuration? If you set SSLCertificateChainFile on
virtualhost level it should do what you want. Alternatively have you checked
not using SSLCertificateChainFile and instead putting the chain in the same
file as the certificate?

-- 
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org

[Bug 65594] Incorrect certificate chain sent to client

Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=65594

--- Comment #2 from Marc Stern <ma...@approach.be> ---
Putting the chain in the same file as the certificate is not compatible with
storing the private key in teh same file. I tried all combinations.

Set SSLCertificateChainFile on virtualhost level is indeed an option.

Example of file:
-----BEGIN CERTIFICATE-----
CA1
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
Root1
-----END CERTIFICATE-----

-----BEGIN CERTIFICATE-----
CA2
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
Root2
-----END CERTIFICATE-----

-- 
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org

[Bug 65594] Incorrect certificate chain sent to client

Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=65594

--- Comment #4 from Marc Stern <ma...@approach.be> ---
It's a work-around, yes.
But people may wonder for long why their site isn't working with
Facebook/Linkedin publishing (and all other tools using the same library).

-- 
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org

[Bug 65594] Incorrect certificate chain sent to client

Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=65594

--- Comment #3 from Ruediger Pluem <rp...@apache.org> ---
(In reply to Marc Stern from comment #2)
> Putting the chain in the same file as the certificate is not compatible with
> storing the private key in teh same file. I tried all combinations.
> 
> Set SSLCertificateChainFile on virtualhost level is indeed an option.
> 
 So this solves your problem?

-- 
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org

[Bug 65594] Incorrect certificate chain sent to client

Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=65594

Rich Bowen <rb...@apache.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEEDINFO                    |RESOLVED
         Resolution|---                         |WONTFIX

--- Comment #5 from Rich Bowen <rb...@apache.org> ---
Thank you for your report. This ticket has been in NEEDINFO status with no
response for more than 1 year. If you still experience this issue with a
current version of Apache httpd (2.4.x or trunk), please open a new ticket with
updated details. We are closing this ticket due to inactivity.

-- 
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org