When configuring a site to use encryption on Aegir, it adds two lines in the vhost for the SSL certificate:

    SSLCertificateFile /var/aegir/config/server_master/ssl.d/site.tld/openssl.crt
    SSLCertificateKeyFile /var/aegir/config/server_master/ssl.d/site.tld/openssl.key

With this combo, Apache doesn't know what intermediate CA file to send with the certificate. This means that certificates don't verify cleanly.

If I'm not mistaken, the certificate files get their intermediate CA appended automatically, so the fix should be simple -- to add one line in each vhost that fetches the chain certificate from the same file as the cert itself:

    SSLCertificateChainFile /var/aegir/config/server_master/ssl.d/site.tld/openssl.crt

Comments

helmo’s picture

helmo CreditAttribution: helmo at Initfour websolutions commented
Project: Hostmaster (Aegir) » Hosting
Issue tags: +aegir-ssl

Such a line is already being included in http/Provision/Config/Apache/Ssl/vhost_ssl.tpl.php based on the ssl_chain_cert variable.

If you add a file called 'openssl_chain.crt' next to the other certificate files it should be picked up automatically.

  • helmo committed 5d938dc on 7.x-3.x 
    Issue #2475455: Document the place for am intermediate certificate.
helmo’s picture

helmo CreditAttribution: helmo at Initfour websolutions commented
Status: Active » Fixed
anarcat’s picture

anarcat CreditAttribution: anarcat commented
Status: Fixed » Closed (fixed)

wow, duh, okay, sorry for the noise. :)