This site will have limited functionality while we undergo maintenance to improve your experience. If an article doesn't solve your issue and you want to ask a question, we have our support community waiting to help you at @FirefoxSupport on Twitter and/r/firefox on Reddit.

Avatar for Username

Search Support

Avoid support scams. We will never ask you to call or text a phone number or share personal information. Please report suspicious activity using the “Report Abuse” option.

Learn More

This thread was archived. Please ask a new question if you need help.

Firefox handling of certificate chains

  • 4 replies
  • 1 has this problem
  • 19 views
  • Last reply by paul46

paul46
paul46
more options

I have a scenario where the website being connected to, has a three level chain (Intermediate1, Intermediate2, Root). Both Intermediate2 and root CA's are present in the Firefox default trusted CA store (They are Centrum based certs). However the Intermediate1 cert (SpaceSSL CA) is not in the Firefox default trusted CA store, and consequently flags a problem when connecting to this website.

From a usability perspective it is not feasible for users to manually install the untrusted CA intermediate cert into Firefox (although this overcomes the connectivity issues if manually imported to the FF store).

Therefore I was wondering whether if the website server supplies the full cert chain file to Firefox whether Firefox will use that to 'bypass' the lack of trust of the SpaceSSL certificate or whether the same trust issues will remain (since SpaceSSL CA is not in the trusted store of FF).

Many thanks for the help.

Paul

I have a scenario where the website being connected to, has a three level chain (Intermediate1, Intermediate2, Root). Both Intermediate2 and root CA's are present in the Firefox default trusted CA store (They are Centrum based certs). However the Intermediate1 cert (SpaceSSL CA) is not in the Firefox default trusted CA store, and consequently flags a problem when connecting to this website. From a usability perspective it is not feasible for users to manually install the untrusted CA intermediate cert into Firefox (although this overcomes the connectivity issues if manually imported to the FF store). Therefore I was wondering whether if the website server supplies the full cert chain file to Firefox whether Firefox will use that to 'bypass' the lack of trust of the SpaceSSL certificate or whether the same trust issues will remain (since SpaceSSL CA is not in the trusted store of FF). Many thanks for the help. Paul

All Replies (4)

jscher2000 - Support Volunteer
jscher2000 - Support Volunteer
  • Top 25 Contributor
more options

Hi Paul, Firefox expects websites to provide all intermediate certs needed to verify the site certificate up to a built-in root certificate. The certificate issuer typically provides a bundle file for that.

(Since Firefox caches intermediate certificates after verifying them, users may have different experiences with the site depending on whether they have used sites that have the same certificate chain.)

You can use the Qualys test page to verify that your chain is complete: https://www.ssllabs.com/ssltest/

paul46
paul46 Question owner
more options

Thanks very much @jscher2000.

Just to clarify my understanding. Does this mean that if Firefox receives the cert chain file from the server which includes the full intermediate/root chain (including an already trusted root) that FF will fully trust the connection and will not flag any trust errors - even if the signed certificate is signed by an untrusted intermediate CA in that chain?

Thanks again.

jscher2000 - Support Volunteer
jscher2000 - Support Volunteer
  • Top 25 Contributor
more options

Hi Paul, trust is established on the fly by checking the certificate signatures. Firefox often has not seen an intermediate cert before, but it can be trusted as long as it was validly signed and can be verified up to a trusted root certificate. After verification, it will be cached and show up in the Certificate Manager dialog, Authorities tab, with the designation "Software Security Device" (instead of "Builtin Object Token").

The server doesn't need to send the root certificate that is already included with browsers, and probably shouldn't. I think the SSL Labs test views that as a configuration error. Your bundle only needs to include the intermediate certs. Your certificate issuer should tell you which ones you need to serve.

paul46
paul46 Question owner
more options

Great. Thanks very much. Understood. I appreciate the speedy assistance.