Bug 65594 - Incorrect certificate chain sent to client
Summary: Incorrect certificate chain sent to client
Status: NEEDINFO
Alias: None
Product: Apache httpd-2
Classification: Unclassified
Component: mod_ssl (show other bugs)
Version: 2.4.37
Hardware: All All
: P2 major (vote)
Target Milestone: ---
Assignee: Apache HTTPD Bugs Mailing List
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2021-09-23 08:39 UTC by Marc Stern
Modified: 2021-09-23 10:46 UTC (History)
0 users


Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Marc Stern 2021-09-23 08:39:08 UTC 
When using SSLCertificateChainFile with certificates belonging to different chains, httpd sends all certificates to the client instead of only the chain.
Although most browsers accept it, some clients refuse this (like Facebook and Linkedin preview clients).
Only certificates belonging to the current chain should be sent.
Comment 1 Ruediger Pluem 2021-09-23 09:18:41 UTC 
Can you give an example configuration? If you set SSLCertificateChainFile on virtualhost level it should do what you want. Alternatively have you checked not using SSLCertificateChainFile and instead putting the chain in the same file as the certificate?
Comment 2 Marc Stern 2021-09-23 09:26:20 UTC 
Putting the chain in the same file as the certificate is not compatible with storing the private key in teh same file. I tried all combinations.

Set SSLCertificateChainFile on virtualhost level is indeed an option.

Example of file:
-----BEGIN CERTIFICATE-----
CA1
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
Root1
-----END CERTIFICATE-----

-----BEGIN CERTIFICATE-----
CA2
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
Root2
-----END CERTIFICATE-----
Comment 3 Ruediger Pluem 2021-09-23 09:42:00 UTC 
(In reply to Marc Stern from comment #2)
> Putting the chain in the same file as the certificate is not compatible with
> storing the private key in teh same file. I tried all combinations.
> 
> Set SSLCertificateChainFile on virtualhost level is indeed an option.
> 
 So this solves your problem?
Comment 4 Marc Stern 2021-09-23 10:46:14 UTC 
It's a work-around, yes.
But people may wonder for long why their site isn't working with Facebook/Linkedin publishing (and all other tools using the same library).