Sign in

the missing link in our certificate chain (literally)

certificateshttpstls4 replies 路 85 views 路 started
Reply
  1. Tomas L.
    @tomas_cobalt

    so annoyed rn integration patrner says calls from our Java service to our customer portal fail with a certificate error:

    When I open teh URL in my browser its perfectly fine. Theyre blaming us, were blaming them. Whos right?

    i dont wanna tell them to disable certificate verification, that feels like the wrong answer. but i also need proof of whether the problem is on our side. how do i check this properly?? pls help 馃檹

    5
  2. Vik Petrov
    @vik.petrov

    uhh what does openssl s_client -showcerts list: one certificate, or the leaf plus intermediate?

    2 3 helpful
  4. Wren
    @wren_cron

    hmmm java and Python clients use their own trust stroes... java uses cacerts in the JRE; Python requests uses the certifi bundle. If the root is new or private, those stores need updating even when the OS trsuts it. fingers crossed 馃

    2 0 helpful
  5. Rhea Larsen
    @nimbus_monk129

    Most lkiely teh server isnt sending the intermediate certificate. Desktop browsers often fill it in from cache or via AIA fetching, but many clients (curl included) dont. Check what teh server sends:

    openssl s_client -connect host:443 -servername host -showcerts

    If you only see one certificate, teh chain is incomplete. hope that helps :)

    1 1 helpful

Reply to this topic

Sign in or create an account to reply.