Re: FIXED - Re: Broken SSL cert caused by router?

[Mike <mike-nanog () tiedyenetworks com>]

On 03/28/2015 01:50 PM, Matt Palmer wrote:
> On Sat, Mar 28, 2015 at 09:05:38AM -0700, Mike wrote:
> > On 03/27/2015 10:34 AM, Frank Bulk wrote:
> > > Glad you figured that out.
> > >
> > > I've used three SSL evaluation websites to help me with intermediate certificate issues:
> > > https://www.ssllabs.com/ssltest/analyze.html (will show the names and details of the certs, missing or not
> > > https://www.wormly.com/test_ssl (quick SSL tester, will point out if intermediate certificate is missing)
> > > https://www.digicert.com/help/ (will show a green chain link between certs when they're all there *and* in order)
> > I went back to Frank's list and did some additional testing. I have a
> > different server which was set up the same way as the previous one
> > discussed, and I thought I would use the above tools and see if my problem
> > would have been identified by any of them. I am sorry to report, no, none of
> > these either caught the problem either.
> Are you able to share the URL of the misconfigured site?  It would be
> interesting to examine exactly what's going on.
>
> - Matt
SSLCertificateChainFile /etc/ssl/certs/gd_bundle-g2-g1.crt

I have actually fixed it.

What was going on seems to be this -

I have a new godaddy certificate for *.mydomain.com, and that is what I 
installed. However, the certificate chain I supplied was missing some 
intermediate godaddy certificate. Originally, it appeared I was missing 
'gdig2.crt', and once installed, that fixed some clients including the 
ones behind the meraki router. But then there were also some older 
clients this did not fix (a macos 10.4 something for example). So I went 
back and installed gd_bundle-g2-g1.crt in it's place, and that seems to 
have finally done it.

I apologize for the diminishing lack of operational content. It just 
seems that these ssl tests should be tightened up and perhaps some 
additional tools deployed out there to help us less knowledgeable folks 
'get it right'.


Mike-