I'm getting an error "Chain issues: Incorrect order, Extra certs" from https://www.ssllabs.com/ssltest/analyze.html?d=api.quotecrunchers.com when I test the SSL for my website.
I've built the https mechanism into a spring boot application using the following:
The acme4j library to communicate with the Let's Encrypt CA.
Java code to write the Let's Encrypt certificate to a java keystore.
Java code to cause the embedded Tomcat server to apply for a certificate from Let's Encrypt over HTTP and then restart using HTTPS once it has the certificate.
I'm planning on open sourcing this code once I've got it tidied up.
Currently though, I'm only achieving a B rating using ssllabs.com
See https://www.ssllabs.com/ssltest/analyze.html?d=api.quotecrunchers.com
There are several issues with my https, but the issue I am concerned about is where it says "Chain issues: Incorrect order, Extra certs".
Why am I getting this, and what should I be doing instead?
Any help is greatly appreciated!
When one connects to your site, here is what is sent by it as seen by openssl s_client:
Certificate chain
0 s:/CN=api.quotecrunchers.com
i:/C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3
1 s:/CN=api.quotecrunchers.com
i:/C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3
2 s:/C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3
i:/O=Digital Signature Trust Co./CN=DST Root CA X3
As you can see the first certificate is duplicated which is exactly the reason of the rating and error message.
When you configure a TLS server you specify typically on one end the end (server) certificate, that is one certificate, and it would appear in position 0 in a trace like above, and then you (optionnally, but very frequently) provide a potential list of chained certificates, called "intermediate" that links your end certificate to some root (CA) certificate, the CA certificate itself may be the last one in the chain or be skipped altogether.
That would have been in position 1 and later in the trace above.
But as you can see, at position 1, hence as intermediate certificate, we find again your end certificate.
This is not correct per the TLS standard so you need to change your configuration or the file containing the intermediate certificates to remove your end certificate from this spot, so that you finally manage to get:
Certificate chain
0 s:/CN=api.quotecrunchers.com
i:/C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3
1 s:/C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3
i:/O=Digital Signature Trust Co./CN=DST Root CA X3
Collected from the Internet
Please contact [email protected] to delete if infringement.
Comments