SSL cert “err_cert_authority_invalid” on mobile chrome only

后端 未结 12 1693
轻奢々
轻奢々 2021-01-30 12:22

Domain: https://www.amz2btc.com

Analysis from SSL Labs: https://www.ssllabs.com/ssltest/analyze.html?d=amz2btc.com

All my desktop browsers open this fine. Mob

相关标签:
12条回答
  • 2021-01-30 13:08

    I just spent the morning dealing with this. The problem wasn't that I had a certificate missing. It was that I had an extra.

    I started out with my ssl.conf containing my server key and three files provided by my SSL certificate authority:

    #   Server Certificate:
    SSLCertificateFile /etc/pki/tls/certs/myserver.cer
    
    #   Server Private Key:
    SSLCertificateKeyFile /etc/pki/tls/private/myserver.key
    
    #   Server Certificate Chain:
    SSLCertificateChainFile /etc/pki/tls/certs/AddTrustExternalCARoot.pem
    
    #   Certificate Authority (CA):
    SSLCACertificateFile /etc/pki/tls/certs/InCommonServerCA.pem
    

    It worked fine on desktops, but Chrome on Android gave me err_cert_authority_invalid

    A lot of headaches, searching and poor documentation later, I figured out that it was the Server Certificate Chain:

    SSLCertificateChainFile /etc/pki/tls/certs/AddTrustExternalCARoot.pem
    

    That was creating a second certificate chain which was incomplete. I commented out that line, leaving me with

    #   Server Certificate:
    SSLCertificateFile /etc/pki/tls/certs/myserver.cer
    
    #   Server Private Key:
    SSLCertificateKeyFile /etc/pki/tls/private/myserver.key
    
    #   Certificate Authority (CA):
    SSLCACertificateFile /etc/pki/tls/certs/InCommonServerCA.pem
    

    and now it's working on Android again. This was on Linux running Apache 2.2.

    0 讨论(0)
  • 2021-01-30 13:18

    if you're like me who is using AWS and CloudFront, here's how to solve the issue. it's similar to what others have shared except you don't use your domain's crt file, just what comodo emailed you.

    cat COMODORSADomainValidationSecureServerCA.crt COMODORSAAddTrustCA.crt AddTrustExternalCARoot.crt > ssl-bundle.crt
    

    this worked for me and my site no longer displays the ssl warning on chrome in android.

    0 讨论(0)
  • 2021-01-30 13:22

    I also had a problem with the chain and managed to solve using this guide https://gist.github.com/bradmontgomery/6487319

    0 讨论(0)
  • 2021-01-30 13:24

    I solved my problem with this commands:

    cat __mydomain_com.crt __mydomain_com.ca-bundle > __mydomain_com_combine.crt
    

    and after:

    cat __mydomain_com_combine.crt COMODORSADomainValidationSecureServerCA.crt 
    COMODORSAAddTrustCA.crt AddTrustExternalCARoot.crt > mydomain.pem
    

    And in my domain nginx .conf I put on the server 443:

    ssl_certificate          ssl/mydomain.pem;
    ssl_certificate_key      ssl/mydomain.private.key;
    

    I don't forget restart your "Nginx"

    service nginx restart
    
    0 讨论(0)
  • 2021-01-30 13:24

    Just do the following for Version 44.0.2403.155 dev-m

    Privacy -->Content settings -->Do not allow any site to run JavaScript

    Problem Solved

    0 讨论(0)
  • 2021-01-30 13:27

    A decent way to check whether there is an issue in your certificate chain is to use this website:

    https://www.digicert.com/help/

    Plug in your test URL and it will tell you what may be wrong. We had an issue with the same symptom as you, and our issue was diagnosed as being due to intermediate certificates.

    SSL Certificate is not trusted

    The certificate is not signed by a trusted authority (checking against Mozilla's root store). If you bought the certificate from a trusted authority, you probably just need to install one or more Intermediate certificates. Contact your certificate provider for assistance doing this for your server platform.

    0 讨论(0)
提交回复
热议问题