SSL cert "err_cert_authority_invalid" on mobile chrome only

Question

Analysis from SSL Labs: https://www.ssllabs.com/ssltest/analyze.html?d=amz2btc.com

All my desktop browsers open this fine. Mobile Firefox opens this fine. Only when I tried with mobile Chrome did I get the error: err_cert_authority_invalid

I know very little about SSL, so I can't really make sense of the SSL report or why this error is coming up. If someone could ELI5, that would be ideal. :)

i'm also having this issue now. it worked a few weeks ago but now android chrome is getting the other. every other browser works fine. the difference with me though is i have my site hosted in AWS S3 and CloudFront. i installed the certificate in cloudfront. any guides, tips, resources for that configuration? — w1n78, Jun 16 '15 at 06:17
Duplicate of http://stackoverflow.com/questions/13862908/ssl-certificate-is-not-trusted-on-mobile-only — reinierpost, Jun 22 '16 at 17:36

score 28 · Answer 1 · answered Feb 02 '15 at 18:26

I just spent the morning dealing with this. The problem wasn't that I had a certificate missing. It was that I had an extra.

I started out with my ssl.conf containing my server key and three files provided by my SSL certificate authority:

#   Server Certificate:
SSLCertificateFile /etc/pki/tls/certs/myserver.cer

#   Server Private Key:
SSLCertificateKeyFile /etc/pki/tls/private/myserver.key

#   Server Certificate Chain:
SSLCertificateChainFile /etc/pki/tls/certs/AddTrustExternalCARoot.pem

#   Certificate Authority (CA):
SSLCACertificateFile /etc/pki/tls/certs/InCommonServerCA.pem

It worked fine on desktops, but Chrome on Android gave me err_cert_authority_invalid

A lot of headaches, searching and poor documentation later, I figured out that it was the Server Certificate Chain:

SSLCertificateChainFile /etc/pki/tls/certs/AddTrustExternalCARoot.pem

That was creating a second certificate chain which was incomplete. I commented out that line, leaving me with

#   Server Certificate:
SSLCertificateFile /etc/pki/tls/certs/myserver.cer

#   Server Private Key:
SSLCertificateKeyFile /etc/pki/tls/private/myserver.key

#   Certificate Authority (CA):
SSLCACertificateFile /etc/pki/tls/certs/InCommonServerCA.pem

and now it's working on Android again. This was on Linux running Apache 2.2.

Worked on Apache 2.4.7 (tested at 23/06) – Paladini Jun 23 '16 at 20:29 — Paladini, Jun 23 '16 at 20:29

score 18 · Answer 2 · answered Jan 14 '16 at 06:17

I had this same problem while hosting a web site via Parse and using a Comodo SSL cert resold by NameCheap.

You will receive two cert files inside of a zip folder: www_yourdomain_com.ca-bundle www_yourdomain_com.crt

You can only upload one file to Parse: Parse SSL Cert Input Box

In terminal combine the two files using:

cat www_yourdomain_com.crt www_yourdomain_com.ca-bundle > www_yourdomain_com_combine.crt

Then upload to Parse. This should fix the issue with Android Chrome and Firefox browsers. You can verify that it worked by testing it at https://www.sslchecker.com/sslchecker

Alex from Jitbit · Answer 3 · 2015-12-29T23:17:51.927

For those having this problem on IIS servers.

Explanation: sometimes certificates carry an URL of an intermediate certificate instead of the actual certificate. Desktop browsers can DOWNLOAD the missing intermediate certificate using this URL. But older mobile browsers are unable to do that. So they throw this warning.

You need to

1) make sure all intermediate certificates are served by the server

2) disable unneeded certification paths in IIS - Under "Trusted Root Certification Authorities", you need to "disable all purposes" for the certificate that triggers the download.

PS. my colleague has wrote a blog post with more detailed steps: https://www.jitbit.com/maxblog/21-errcertauthorityinvalid-on-android-and-iis/

Worked for me. COMODO RSA Certification Authority was the problem in my case - as explained in your link. — Jendrik, Jan 27 '17 at 13:07

score 7 · Answer 4 · edited May 29 '15 at 14:48

7

The report from SSLabs says:

  This server's certificate chain is incomplete. Grade capped to B.
  ....
  Chain Issues                  Incomplete

Desktop browsers often have chain certificates cached from previous connections or download them from the URL specified in the certificate. Mobile browsers and other applications usually don't.

Fix your chain by including the missing certificates and everything should be right.

edited May 29 '15 at 14:48

Sursh

25
4

answered Jan 12 '15 at 05:55

Steffen Ullrich

114,247
10
131
172

3

At the risk of sounding completely incompetent (which, ya know, I may be), how exactly do I do that? I had to follow a step-by-step guide getting my own cert installed in WHM... I really know next to nothing about this. – S. J. Jan 12 '15 at 17:49
I know nothing about WHM, but usually the sellers of the certificates provide documentation which intermediate certificates are required (they depend on the seller) and how to install them in common software. So you better look where you got the certificate from. – Steffen Ullrich Jan 12 '15 at 19:20
I also had an incomplete chain. In my case, it was solved by specifying SSLCertificateChainFile in my apache 2.4.7 config. This directive is no longer needed from Apache 2.4.8: https://httpd.apache.org/docs/current/mod/mod_ssl.html#sslcertificatechainfile – marcovtwout Jan 30 '17 at 20:51

score 5 · Answer 5 · edited Jun 18 '15 at 15:46

I hope i am not too late, this solution here worked for me, i am using COMODO SSL, the above solutions seem invalid over time, my website lifetanstic.co.ke

Instead of contacting Comodo Support and gain a CA bundle file You can do the following:

When You get your new SSL cert from Comodo (by mail) they have a zip file attached. You need to unzip the zip-file and open the following files in a text editor like notepad:

AddTrustExternalCARoot.crt
COMODORSAAddTrustCA.crt
COMODORSADomainValidationSecureServerCA.crt

Then copy the text of each ".crt" file and paste the texts above eachother in the "Certificate Authority Bundle (optional)" field.

After that just add the SSL cert as usual in the "Certificate" field and click at "Autofil by Certificate" button and hit "Install".

Inspired by this gist: https://gist.github.com/ipedrazas/6d6c31144636d586dcc3

I had same problem with COMODO also, but in my case the fix was concat mydomain.crt COMODORSADomainValidationSecureServerCA.crt COMODORSAAddTrustCA.crt > final-file.crt (in this order) and without AddTrustExternalCARoot.crt — FlorianB, Apr 05 '17 at 05:30

score 4 · Answer 6 · answered Mar 29 '15 at 21:05

4

I also had a problem with the chain and managed to solve using this guide https://gist.github.com/bradmontgomery/6487319

answered Mar 29 '15 at 21:05

Ricardo Torres

83
5

score 4 · Answer 7 · answered Jun 19 '15 at 16:49

4

if you're like me who is using AWS and CloudFront, here's how to solve the issue. it's similar to what others have shared except you don't use your domain's crt file, just what comodo emailed you.

cat COMODORSADomainValidationSecureServerCA.crt COMODORSAAddTrustCA.crt AddTrustExternalCARoot.crt > ssl-bundle.crt

this worked for me and my site no longer displays the ssl warning on chrome in android.

answered Jun 19 '15 at 16:49

w1n78

789
1
7
19

2

you have to include your own .crt too in this command... took me a minute or two to realize that – TomTasche Sep 12 '15 at 20:34

score 4 · Answer 8 · answered Aug 17 '16 at 14:47

A decent way to check whether there is an issue in your certificate chain is to use this website:

https://www.digicert.com/help/

Plug in your test URL and it will tell you what may be wrong. We had an issue with the same symptom as you, and our issue was diagnosed as being due to intermediate certificates.

SSL Certificate is not trusted

The certificate is not signed by a trusted authority (checking against Mozilla's root store). If you bought the certificate from a trusted authority, you probably just need to install one or more Intermediate certificates. Contact your certificate provider for assistance doing this for your server platform.

score 3 · Answer 9 · answered Mar 20 '16 at 06:38

I solved my problem with this commands:

cat __mydomain_com.crt __mydomain_com.ca-bundle > __mydomain_com_combine.crt

and after:

cat __mydomain_com_combine.crt COMODORSADomainValidationSecureServerCA.crt 
COMODORSAAddTrustCA.crt AddTrustExternalCARoot.crt > mydomain.pem

And in my domain nginx .conf I put on the server 443:

ssl_certificate          ssl/mydomain.pem;
ssl_certificate_key      ssl/mydomain.private.key;

I don't forget restart your "Nginx"

service nginx restart

score 0 · Answer 10 · answered Feb 12 '15 at 10:58

I had the same probleme but the response made by Mike A helped me to figure it out: I had a my certificate, an intermediate certificate (Gandi) , an other intermediate (UserTrustRSA) and finally the RootCA certificate (AddTrust).

So first i made a chain file with Gandi+UserTrustRSA+AddTrust and specified it with SSLCertificateChainFile. But it didn't worked.

So i tried MikeA answer by just putting AddTruct cert in a file and specified it with SSLCACertificateFile and removing SSLCertificateChainFile.But it didn't worked.

So finnaly i made a chain file with only Gandi+UserTrustRSA specified by SSLCertificateChainFile and the other file with only the RootCA specified by SSLCACertificateFile and it worked.

#   Server Certificate:
SSLCertificateFile /etc/ssl/apache/myserver.cer

#   Server Private Key:
SSLCertificateKeyFile /etc/ssl/apache/myserver.key

#   Server Certificate Chain:
SSLCertificateChainFile /etc/ssl/apache/Gandi+UserTrustRSA.pem

#   Certificate Authority (CA):
SSLCACertificateFile /etc/ssl/apache/AddTrust.pem

Seems logical when you read but hope it helps.

score 0 · Answer 11 · answered Apr 07 '16 at 12:37

0

I guess you should install CA certificate form one if authority canter:

ssl_trusted_certificate ssl/SSL_CA_Bundle.pem;

answered Apr 07 '16 at 12:37

Michael de Oz

27
3

score -12 · Answer 12 · answered Aug 20 '15 at 16:13

-12

Just do the following for Version 44.0.2403.155 dev-m

Privacy -->Content settings -->Do not allow any site to run JavaScript

Problem Solved

answered Aug 20 '15 at 16:13

Dushyant Dave

1

SSL cert "err_cert_authority_invalid" on mobile chrome only

12 Answers12

Linked