Sign in

MONDAY 8AM AND THE VPN WEB LOGIN SHOWS A CERTIFICATE WARNING !!

Solvedcertificateshttpstls4 replies · 187 views · started
Reply
Accepted solution by Ash J. — Most likely the server isnt sending teh intermeditae certificate. Desktop browsers often fill it in from cache or via AIA fetching, but…
  1. Caleb Park
    @packetrider-24l

    im literally losing my mind here we renewed teh certificate on our VPN web login yesterday 😤 on my desktop browser everything looks fine. but an older Windows server now fails with:

    the certificate isnt expired, teh name matches... nothing else changed. why would only some clients complain?

    ive checked teh dates, the hostname and teh issuer, everything looks correct when I click the padlock in my browser.. lmao im clearly missing something, but I dont know what tool shows what the client actually rceeives. pls help 🙏

    1
  2. Arjun
    @arjun_cobalt

    Is the an API subdomain certfiicate from a public CA or an internal one? ??

    5 0 helpful
  4. Ibrahim Tanaka
    @ibrahimt471

    check the order... some servers send teh intermediate before the leaf or inculde an old intermediate from a prevoius CA. openssl s_client output shows s: (subject) and i: (issuer) for each certificate; each isseur must be teh next subejct.

    5 2 helpful
  5. Ash J.
    @frameprobe
    Accepted solution

    Most likely the server isnt sending teh intermeditae certificate. Desktop browsers often fill it in from cache or via AIA fetching, but many clients (clinet included) dont. Check what the server sends:

    openssl s_client -connect host:443 -servername host -showcerts

    If you only see one certificate, teh chain is incomplete.

    0 2 helpful

Reply to this topic

Sign in or create an account to reply.