Avatar for Username

Hilfe durchsuchen

Vorsicht vor Support-Betrug: Wir fordern Sie niemals auf, eine Telefonnummer anzurufen, eine SMS an eine Telefonnummer zu senden oder persönliche Daten preiszugeben. Bitte melden Sie verdächtige Aktivitäten über die Funktion „Missbrauch melden“.

Weitere Informationen

Dieses Thema wurde archiviert. Bitte stellen Sie eine neue Frage, wenn Sie Hilfe benötigen.

Intermediate certification authorities chain fails

  • 4 Antworten
  • 16 haben dieses Problem
  • 2 Aufrufe
  • Letzte Antwort von tosiara

tosiara
tosiara
more options

After importing RootCA FireFox still can not load a web page signed by intermediate certification authorities.

Root CA certificate: http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/971D3486FC1E8E6315F7C6F2E12967C724342214.crt

Web Site: https://id.rcsc.lt/

Certificate Chain should look like:

RootCa 

PolicyCA
  IssuingCA
    id.rcsc.lt


I have tried IE and Opera and both working fine and detecting certificate chain. Only need to import RootCA cert to establish trust

Why FireFox does not work as expected?

After importing RootCA FireFox still can not load a web page signed by intermediate certification authorities. Root CA certificate: http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/971D3486FC1E8E6315F7C6F2E12967C724342214.crt Web Site: https://id.rcsc.lt/ Certificate Chain should look like: RootCa PolicyCA IssuingCA id.rcsc.lt I have tried IE and Opera and both working fine and detecting certificate chain. Only need to import RootCA cert to establish trust Why FireFox does not work as expected?

Alle Antworten (4)

cor-el
cor-el
  • Moderator
  • Top 10 Contributor
more options

A web server needs to send the full chain of intermediate certificates.
Importing the root certificate is not enough.
If the server doesn't send the certificate then you need to install (import) that intermediate certificate as well.

tosiara
tosiara Fragesteller
more options

So how then IE and Opera receive full certificate chain? And why FireFox does not receive it?

tosiara
tosiara Fragesteller
more options

I think I got why IE and Opera works fine

Inside IssuingCA certificate there is a link to upper CA certificate:

[Authority Information Access] OCSP: URI: http://ocsp.rcsc.lt/ocspresponder.rcsc CA Issuers: URI: http://csp.rcsc.lt/aia/VI%20Registru%20Centras%20RCSC%20(PolicyCA)(2).crt

IE and Opera retrieve PolicyCA certificate and then the same way retrieve RootCA certificate. That how they verify trust

The question remains: why FireFox can't do the same?

tosiara
tosiara Fragesteller
more options

Still same in FF5