Forum Discussion

smp_86112's avatar
smp_86112
Icon for Cirrostratus rankCirrostratus
Dec 15, 2011

Managing SSL Certificate Bundles

We are about changing SSL vendors, and it appears their root is already in the build-in "ca-bundle". However, their intermediates are not. I wanted to get some feedback on the right way to manage thes...
config
design
hooleylist's avatar
hooleylist
Icon for Cirrostratus rankCirrostratus
Dec 19, 2011
Your server cert might already be properly chained with intermediate cert(s) to a root cert in the browser (ie the browser already has the intermediate cert(s) and root cert installed). You can check this by viewing the cert in IE and then clicking on the Certification Path.

 

 

I don't think you need to install the root cert in the chain as the client has to have it in order to avoid the unchained (or untrusted) cert error. It doesn't hurt to include the intermediate cert(s) in the bundle for non-standard clients who might not already have it/them installed.

 

 

Aaron