SSL 证书配置错误

Question

Basically facebook scraper ( https://developers.facebook.com/tools/debug/og/object/ ) tells that:

Curl Error : SSL_CACERT SSL certificate problem: unable to get local issuer certificate

Tested my site's url here: https://whatsmychaincert.com/?mysite.com

and this tells: my site is misconfigured. This is the chain it should be using.

I'm scared to download the chain file from this site as I guess I already have it all from GoDaddy .

Coming back to my facebook scraper problem. I did google search and found that the Curl error is due to PHP version. As I checked, I have latest PHP running. But I still downloaded cacert.pem from official site and added in the same folder where my ssl certs reside(/etc/ssl/certs). Then edited php.ini located /opt/bitnami/php/etc .

so it reads:

 curl.cainfo ="/etc/ssl/certs/cacert.pem"

Restarted apache still the issue persisted. So I focused on fixing the SSL cert issue.

This is how my default-ssl.conf looks like:

SSLCertificateFile  /etc/ssl/certs/a639a4be86615af.crt
SSLCertificateKeyFile /etc/ssl/certs/mysite.key

SSLCertificateChainFile /etc/ssl/certs/mysite.com.chain.crt (downloaded from https://whatsmychaincert.com/)

SSLCACertificateFile /etc/ssl/certs/a639a4be86615af.pem

Bytheway my site shows https connection. But in Firefox I dont see any images loaded. Could that related to the (unable to get local issuer certificate)

What's wrong with my configuration? How do I fix it?

EDIT: I'm using wordpress bitnami set.So I edited two paths for the ssl config. /etc/apache2/sites-available/default-ssl.conf and /opt/bitnami/apache2/conf/extra/httpd-ssl.conf

My latest SSL config file:

<IfModule mod_ssl.c>
    <VirtualHost _default_:443>
        ServerAdmin hello@mysite.com
        ServerName mysite.com

        DocumentRoot /var/www/html

        ErrorLog ${APACHE_LOG_DIR}/error.log
        CustomLog ${APACHE_LOG_DIR}/access.log combined

        SSLEngine on

        SSLCertificateFile      /etc/ssl/certs/b8ad60af28cd1745.crt
        SSLCertificateKeyFile /etc/ssl/private/mysite.key
        SSLCertificateChainFile /etc/ssl/certs/b8ad60af28cd1745.pem

        <FilesMatch "\.(cgi|shtml|phtml|php)$">
              SSLOptions +StdEnvVars
        </FilesMatch>
        <Directory /usr/lib/cgi-bin>
              SSLOptions +StdEnvVars
        </Directory>

    </VirtualHost>
</IfModule>

Answer 1

Unlike browsers PHP Curl doesn't reconstruct the certificate tree from other sources. So if your cert tree is incomplete, CURL cannot verify your site certificate.

Your VirtualHost configuration should have following:

• SSLCertificateFile - your site certificate
• SSLCertificateKeyFile - key for the CertificateFile
• SSLCertificateChainFile - file containing all intermediate certificates from leaf to root (so curl can connect your certificate to the one in /etc/ssl/certs/cacert.pem )

Since 2.4.8 you can put all certificates from leaf to root into SSLCertificateFile ( https://httpd.apache.org/docs/2.4/mod/mod_ssl.html#sslcertificatefile )

You can test your SSL configuration using https://www.ssllabs.com/ssltest/index.html which also reports incomplete certificate tree.