Step 2: Preparing The Certificate Chain - Colubris Networks CN3000 Administrator's Manual

Chapter 10 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - SSL certificates - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Chapter 10

Step 2: Preparing the certificate chain

When a web browser connects to the CN3000 using SSL, the CN3000 only sends its
own SSL certificate to the browser. This means that if the certificate has been signed by
an intermediate certificate authority, and if the web browser only knows about the root
certificate authority that signed the Public Key Certificate of the Intermediate certificate
authority, the web browser will not get the whole certificate chain it needs to validate the
identity of the CN3000.
Note: This does not apply when using self-signed certificates, since these certificates
implicitly contain the whole chain.
To resolve this problem all the public key certificates must be appended to the certificate
(www.company.com.pem file, for example) in base64 format.
For example, if the CN3000 certificate has been signed by an intermediate CA (CA2),
and if the public key certificate for CA2 was signed by CA1 root CA, the following
certificates should be appended to the file www.company.com.pem.
-----BEGIN CERTIFICATE-----
this is CA1 certificate
in BASE64/PEM encoding
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
this is CA2 certificate
in BASE64/PEM encoding
-----END CERTIFICATE-----
When done, the www.company.com.pem file should look like this:
-----BEGIN CERTIFICATE-----
insert the www.company.com certificate in BASE64/PEM encoding
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
insert the CA1 certificate in BASE64/PEM encoding
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
insert the CA2 certificate in BASE64/PEM encoding
-----END CERTIFICATE-----
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 205 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -