Firefox表示即使证书链很好，证书还是不受信任的

https://www.bigfont.ca的HTTPS可在Chrome，Internet Explorer和Safari中使用，但不能在Firefox中使用。它还通过了此SSL Checkers的所有测试。Firefox说：

连接到www.bigfont.ca时发生错误。对等方的证书已被标记为用户不信任。（错误代码：sec_error_untrusted_cert）

这是Firefox的已知情况。我们查看了StartSSL常见问题，其建议是：

您必须将中间CA证书添加到您的安装中。

我们正在使用SmartSSL和OpenSSL创建SSL证书。因此，我们按照Troy Hunt的教程添加了中间CA证书，并运行了此命令以创建PFX。

OpenSSL> pkcs12 -export -in bigfont.ca.crt -inkey bigfont.ca-encrypted.key 
-certfile sub.class1.server.ca.pem -out bigfont.ca.pfx -password pass:my-password

我们将结果bigfont.ca.pfx文件上传到Azure网站的“配置”页面。

为了进一步测试，我们进行了测试openssl s_client -servername www.bigfont.ca -connect www.bigfont.ca:443 -showcerts。结果表明，证书链运行良好。

depth=1 C = IL, 
O = StartCom Ltd., 
OU = Secure Digital Certificate Signing, 
CN = StartCom Class 1 Primary Intermediate Server CA

verify error:num=20:unable to get local issuer certificate
verify return:0

---
Certificate chain

 0 s:
      /description=T8eg9X1a04Scp3hM
      /C=CA
      /CN=www.bigfont.ca
      /[email protected]
   i:
      /C=IL
      /O=StartCom Ltd.
      /OU=Secure Digital Certificate Signing
      /CN=StartCom Class 1 Primary Intermediate Server CA

-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----

 1 s:
      /C=IL
      /O=StartCom Ltd.
      /OU=Secure Digital Certificate Signing
      /CN=StartCom Class 1 Primary Intermediate Server CA
   i:
      /C=IL
      /O=StartCom Ltd.
      /OU=Secure Digital Certificate Signing
      /CN=StartCom Certification Authority

-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
---
Server certificate
subject=
      /description=T8eg9X1a04Scp3hM
      /C=CA
      /CN=www.bigfont.ca
      /[email protected]
issuer=
      /C=IL
      /O=StartCom Ltd.
      /OU=Secure Digital Certificate Signing
      /CN=StartCom Class 1 Primary Intermediate Server CA

---
No client certificate CA names sent

---
SSL handshake has read 3369 bytes and written 547 bytes

---
New, TLSv1/SSLv3, Cipher is RC4-SHA
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1
    Cipher    : RC4-SHA
    Session-ID: 6E1F00009...FDD7B7BF7B7
    Session-ID-ctx:
    Master-Key: 2FA3C020A506198C1319081F9E023D35...5AEB01985323AADCF9
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    Start Time: 1413947020
    Timeout   : 300 (sec)
    Verify return code: 20 (unable to get local issuer certificate) 

---
read:errno=10054

如果链条正常工作，为什么Firefox会抱怨？