certification and firefox

Virtualmin
1

hello all - sorry to ask such a basic newbie question here. i followed the very excellent instructions found here:

https://www.virtualmin.com/documentation/tutorial/how-to-add-an-ssl-certificate

i chose http://StartSSL.com because it was free.

now the https webpage works on chrome, safari, edge & yandex. however, my friends at Mozilla dont seem to approve.

also, i went to the “StartCom CA Certificates” page, downloaded “StartCom Root CA (PEM encoded)” and then clicked the “CA Certificate” – which now we see this:

Certificate authority name	StartCom Certification Authority
Organization	StartCom Ltd.
Issuer name	StartCom Certification Authority
Issuer organization	StartCom Ltd.
Expiry date	Sep 17 19:46:36 2036 GMT
Certificate type	Self-signed

my question: is my mistake (aside from getting into tech) using a cheapie like StartSSL rather than a more recognizable service?

does virtualmin recommend a particular one ?

2

Hi edwardsmarkf

I am using StartSSL’s certificates on a number of VM sites, and I get an A score for them when I test at Qualys SSL Labs.

I suggest you test here to see if it throws up any problems: https://www.ssllabs.com/ssltest/

It may not be your certificate - it may be something like a poor cipher setup in Apache perhaps?

3

thank you very much PaliGap - what is confusing me is why FF is complaining but nobody else is.

i ran your test and one from digicert as well. both advised me to disable SSLv3 which i did. i now have a letter grade of “B” on digicert.

the Qualys now tells me this:

Protocol Support
TLS 1.0, TLS 1.1, TLS 1.2
SSL certificate
Common Name = www.marksTEST(dot)com
Subject Alternative Names = blah blah
Issuer = StartCom Class 1 Primary Intermediate Server CA
Serial Number = blah blah
SHA1 Thumbprint = blah blah blah blah blah
Key Length = 2048 bit
Signature algorithm = SHA256 + RSA (excellent)
Secure Renegotiation: Supported
This certificate does not use a vulnerable Debian key (this is good)
SSL Certificate has not been revoked
OCSP Staple: 	
OCSP Origin: 	
CRL Status: 	
SSL Certificate expiration
The certificate expires December 2, 2016 (363 days from today)
Certificate Name matches marksTest(dot)com
Subject	www.marksTest(dot)com
Valid from 03/Dec/2015 to 02/Dec/2016
Issuer	StartCom Class 1 Primary Intermediate Server CA
SSL Certificate is correctly installed

Congratulations! This certificate is correctly installed.

FF still gives me “Error code: sec_error_unknown_issuer” - which is why i am tempted to try Comodo instead.

It may not be your certificate - it may be something like a poor cipher setup in Apache perhaps? I should think something like this would cause another browser to complain, or digicert.com/SSLlabs.com to report it.

EDIT: another site on the same server works fine on firefox but i used Comodo for that one. or maybe it just takes a little time for the SSLv3 being disabled to take affect ?

4

Don’t SSLlabs indicate to you why you get ‘B’ and not ‘A’?

5

even more curious: my good website (Comodo cert) which works fine firefox does not work on SSLtest, and i get this message from SSLtest:

Assessment failed: No secure protocols supported

So, do i wait and see if time will fix it, or go ahead and try Comodo instead? Or go back to sacking groceries?

6
This server's certificate chain is incomplete. Grade capped to B.

PaliGap - i logged into StartSSL, went to “StartCom CA Certificate” - which of these options did you choose?

StartCom Root CA (PEM encoded)
StartCom Root CA (DER encoded)
Server Certificate Bundle with CRLs (PEM encoded)

Class 1 Intermediate Server CA
Class 2 Intermediate Server CA
Class 3 Intermediate Server CA
Extended Validation Server CA

Class 1 Intermediate Client CA
Class 2 Intermediate Client CA
Class 3 Intermediate Client CA

Class 2 Code Signing CA
Class 3 Code Signing CA

i am assuming you downloaded one of these and entered it into the FAR-RIGHT tab “Ca Certificate”?

7

That must be bad. There’s your problem right there no doubt.

Did you complete step 22 on that SSL guide you linked to?

8

PaliGap - if i followed every step, then life would be boring.

which of these options did you install?

StartCom Root CA (PEM encoded)
StartCom Root CA (DER encoded)

Server Certificate Bundle with CRLs (PEM encoded)
Class 1 Intermediate Server CA
Class 2 Intermediate Server CA
Class 3 Intermediate Server CA
Extended Validation Server CA

Class 1 Intermediate Client CA
Class 2 Intermediate Client CA
Class 3 Intermediate Client CA

Class 2 Code Signing CA
Class 3 Code Signing CA
9

UPDATE: i installed “Server Certificate Bundle with CRLs (PEM encoded)” and now i get this message from StartSSL:

Assessment failed: No secure protocols supported

That’s the bad news: the good news is that moz-firefox quit complaining, so i am taking a victory lap. Either way, PaliGap will be getting nominated for sainthood.

10

Too late - Pope already calls me “St Paligap” when we’re chatting. His hotline to God now uses TLS…

Great to hear it’s working. I’m very happy with StartSSL’s certificates. At the same time I’m looking forward to VM’s integration with Let’s Encrypt.

11

Saint PaliGap - before you sign off, which of the 12 “StartCom CA Certificates” options did you choose?

12 StartCom CA Certificates

am i the only one out there who thinks this would make a great Christmas Carol ?

12

I believe it was “Class 1 Intermediate Server CA”

In Apache I have this:
SSLCertificateFile /home/mydomain.com/ssl.cert
SSLCertificateKeyFile /home/mydomain.com/ssl.key
SSLCACertificateFile /home/mydomain.com/ssl.ca