Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
Received-SPF: pass (nike.apache.org: domain of nickgearls@gmail.com designates
 209.85.219.216 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=message-id:date:from:user-agent:mime-version:to:subject:references
         :in-reply-to:content-type:content-transfer-encoding;
        b=lpJyJhJ9eyJBxBIoaVJO6BSF+SJpEXlJ+p2ze9Ym+JvpN4lp2EMsdlrrj0EDo3qaUm
         wFrudnT3admosohgtE3glEIZoPUg7ie7FtzUsVRF2ZO6fj5Bc807QPDYpuj2saftyEmU
         qJ5Ei7Cj/BGIxTFelvOKBjMTgdL6hPtFQo0hs=
Message-ID: <4A83B7C5.603@gmail.com>
Date: Thu, 13 Aug 2009 08:50:45 +0200
From: Nick Gearls <nickgearls@gmail.com>
User-Agent: Thunderbird 2.0.0.22 (Windows/20090605)
MIME-Version: 1.0
To: dev@httpd.apache.org
Subject: Re: Certificate chain order not conform to TLS standard
References: <4A82D243.20209@gmail.com>
 <99EA83DCDE961346AFA9B5EC33FEC08B0293E5CF@VF-MBX11.internal.vodafone.com>
In-Reply-To: 
 <99EA83DCDE961346AFA9B5EC33FEC08B0293E5CF@VF-MBX11.internal.vodafone.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 8bit

I tried both order:

	 SSLCertificateFile       conf/ssl/server.pem
	 SSLCertificateChainFile  conf/ssl/chain.pem

where server.pem contains both the cert and the private key,
and chain.pem contains either CA/root or root/CA


Pl�m, R�diger, VF-Group wrote:
>  
> 
>> -----Original Message-----
>> From: Nick Gearls [mailto:nickgearls@gmail.com] 
>> Sent: Mittwoch, 12. August 2009 16:32
>> To: Development Apache
>> Subject: Certificate chain order not conform to TLS standard
>>
>> Hello,
>>
>> I get problems with a picky SSL client complaining that 
>> Apache does not 
>> send the certificate chain in the right order (server/CA/root).
>> Is that possible? Doesn't Apache (I am using 2.2.4) honor the RFC?
> 
> This is not a matter of httpd but a matter in which order you
> put the certificates of the chain in the chainfile.
> Try changing their order in the chainfile.
> 
> 
> Regards
> 
> R�diger
> 
>