[179105] in North American Network Operators' Group
Re: FIXED - Re: Broken SSL cert caused by router?
daemon@ATHENA.MIT.EDU (Mike)
Mon Mar 30 04:29:30 2015
X-Original-To: nanog@nanog.org
Date: Sun, 29 Mar 2015 19:33:03 -0700
From: Mike <mike-nanog@tiedyenetworks.com>
To: nanog@nanog.org
In-Reply-To: <20150328205024.GX12292@hezmatt.org>
Errors-To: nanog-bounces@nanog.org
On 03/28/2015 01:50 PM, Matt Palmer wrote:
> On Sat, Mar 28, 2015 at 09:05:38AM -0700, Mike wrote:
>> On 03/27/2015 10:34 AM, Frank Bulk wrote:
>>> Glad you figured that out.
>>>
>>> I've used three SSL evaluation websites to help me with intermediate certificate issues:
>>> https://www.ssllabs.com/ssltest/analyze.html (will show the names and details of the certs, missing or not
>>> https://www.wormly.com/test_ssl (quick SSL tester, will point out if intermediate certificate is missing)
>>> https://www.digicert.com/help/ (will show a green chain link between certs when they're all there *and* in order)
>> I went back to Frank's list and did some additional testing. I have a
>> different server which was set up the same way as the previous one
>> discussed, and I thought I would use the above tools and see if my problem
>> would have been identified by any of them. I am sorry to report, no, none of
>> these either caught the problem either.
> Are you able to share the URL of the misconfigured site? It would be
> interesting to examine exactly what's going on.
>
> - Matt
>
SSLCertificateChainFile /etc/ssl/certs/gd_bundle-g2-g1.crt
I have actually fixed it.
What was going on seems to be this -
I have a new godaddy certificate for *.mydomain.com, and that is what I
installed. However, the certificate chain I supplied was missing some
intermediate godaddy certificate. Originally, it appeared I was missing
'gdig2.crt', and once installed, that fixed some clients including the
ones behind the meraki router. But then there were also some older
clients this did not fix (a macos 10.4 something for example). So I went
back and installed gd_bundle-g2-g1.crt in it's place, and that seems to
have finally done it.
I apologize for the diminishing lack of operational content. It just
seems that these ssl tests should be tightened up and perhaps some
additional tools deployed out there to help us less knowledgeable folks
'get it right'.
Mike-
