On 12/17/2013 12:42 PM, Sorin Sbârnea wrote:
> As a note EseensialSSL is an intermediate certificate and I also tried
> to add the certificate manually into /etc/ssl/certs/ and run `update-ca-
> certificates` but this had not effect on any of the tests.

You're doing it wrong..

Intermediate certificates are *not* a part of ca-certificates, nor 
should they be added; custom local CA root certificates are *not* added 
to /etc/ssl/certs, read the documentation for ca-certificates; finally, 
the posted askubuntu post is garbage..

The Comodo CA root that signed the EseensialSSL intermediate is already 
in ca-certificates (one of these..) and should be linked in 
/etc/ssl/certs/ by default:

$ ls /usr/share/ca-certificates/mozilla/Comodo_*
/usr/share/ca-certificates/mozilla/Comodo_AAA_Services_root.crt
/usr/share/ca-certificates/mozilla/Comodo_Secure_Services_root.crt
/usr/share/ca-certificates/mozilla/Comodo_Trusted_Services_root.crt

Next would be to properly set up a web server which includes the 
EseensialSSL intermediate certificate to be handed to the client, which 
then follows the chain to the trusted root.  I assume a similar link was 
included with the server certificate:

https://support.comodo.com/index.php?_m=knowledgebase&_a=viewarticle&kbarticleid=964

For non-apache web server software, consult your documentation for 
proper intermediate certificate chaining.

There are lots of sysadmins using EseensialSSL server certificates with 
Debian/Ubuntu client software using various tools like curl and python 
able to establish a chain of trust.  It first takes setting up the web 
service properly.

I sincerely doubt this is an actual bug and is simply user error.

-- 
Kind regards,
Michael

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1261855

Title:
  EssentialSSL (Comodo) certificates are not validated on Ubuntu

To manage notifications about this bug go to:
https://bugs.launchpad.net/curl/+bug/1261855/+subscriptions

-- 
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

Reply via email to