Alex Rivera | Logout

SSL handshake fails with - a verisign chain certificate - that contains two CA signed certificates and one self-signed certificate

Asked 2010-11-05T03:51:24.910
49

I am stuck with a issue and trying to debug it. We purchased a Verisign certificate. When we use:

openssl> s_client -connect myweb.com:443 -showcerts

SSL Handshake never completes and at the end we see error:

Verify return code: 19 (self signed certificate in certificate chain)

It shows 3 ---BEGIN/END CERTIFICATE--- tags. Two certificates in chain are Verisign signed but one is self signed.

  1. If someone can please explain how this self-signed certificate shows up in a CA signed certificate?

  2. Is this error 19 (self signed certificate in certificate chain) benign? If not, what could be causing it?

  3. Client has the CA certificate in trusted store but there is nothing for the self-signed certificate. Do you think that could be causing problem? If yes, how do I:

    1. How can I get rid of the self-signed certificate from the chain certificate leaving behind only 2 CA signed certificates in chain?
    2. Add this self signed certificate on client trusted store?
Edit
Report

2 Answers

9

It sounds like the intermediate certificate is missing. As of April 2006, all SSL certificates issued by VeriSign require the installation of an Intermediate CA Certificate.

It could be that you don't have the entire certificate chain loaded on your server. Some businesses do not allow their computers to download additional certificates, causing a failure to complete an SSL handshake.

Here is some information on intermediate chains:
https://knowledge.verisign.com/support/ssl-certificates-support/index?page=content&id=AR657
https://knowledge.verisign.com/support/ssl-certificates-support/index?page=content&id=AD146

Intermediate CA Certificates

answered 2010-11-05T04:05:13.230
3

Here is a link to VeriSign's SSL Certificate Installation Checker: https://knowledge.verisign.com/support/ssl-certificates-support/index?page=content&id=AR1130

Enter your URL, click "Test this Web Server" and it will tell you if there are issues with your intermediate certificate authority.

answered 2012-03-16T12:38:52.140

Your Answer