Skip to main content

Verisign/Symantec "Failed to configure CA certificate chain!"

I've deployed a few SSL enabled sites in the past but have never encountered as much trouble as I did with Verisign/Symantec Secure Site SSL certificate. And the thing is it can all be blamed on a poorly formatted Download Symantec Secure Site Primary and Secondary Intermediate CA bundle page. Yes even though it does say the word 'Download' you are actually asked to copy and paste; brilliant considering that if you do so your resulting file is malformed due to additional white space on each line

I did not notice the white space until well into my second hour of frustration and pain. Apache just chokes with "Failed to configure CA certificate chain!" or "Unable to configure verify locations for client authentication" errors. For the substantial premium clients pay to use SSL Verisign certificates I must say I really expected better.

To resolve the issue either manually remove the white spaces or create the chain file by copying and pasting from the 'Get Certificate' page (format X.509) the First Intermediate Certificate: and Second Intermediate Certificate: sections - End Entity Certificate: is your SSLCertificateFile.

Hope this helps you out, feel free to follow me on twitter: @danielsokolows or google plus.

Comments

  1. I ran into the exact same problem and your article helped me avoid pulling hairs out! Symantec should fix this ASAP. There are clearly white spaces at the beginning of each line. This is a Symantec BUG.

    ReplyDelete
  2. You saved me too! Thank you and I am glad this was easy to find.

    ReplyDelete
  3. Thank you a lot, your article made me review my intermediate.crt file and i found the problem.
    I was missing one hyphen sign out of five, at the end of file, and it took my days. Thanks again.

    ReplyDelete
  4. THANKS A LOT!!!!!!! Damned VeriSign Copy/Paste stufffffff!!!!

    ReplyDelete

Post a Comment

Popular posts from this blog

Opera SOCKS Proxy Setup Issues

SOCKS error: Connection closed by remote server When setting up SOCKS only proxy in Opera web browser make sure to specify the IP address instead of your fully qualified domain name (FQDN). Using a host name will not work and Opera simply fails to connect to the proxy server. Sample working setup screen shot with a Dante proxy server , note that HTTP, HTTPS, FTP, SSH options are left blank. Bug DSK-364301 has been filled with Opera, if it has been a while since this post and the issue still not fixed feel free to add your word of encouragement by emailing DSK-364301@bugs.opera.com :)

Storing passwords in PuTTY

How to save SSH username/password for auto login in PuTTy The answer is you can't do it...at least in plain PuTTy. However there is an awesome fork with that let's you store the username and password and other additional features called KiTTy.



So grab yourself a copy and +1 this if you do, thanks.

Duplicate value found: duplicates value on record with id: <unknown>.

System.DmlException: Insert failed. First exception on row 0; first error: DUPLICATE_VALUE, duplicate value found: <unknown> duplicates value on record with id: <unknown>.The above error is triggered in the database layer and caused by a trigger or workflow outside of your main code of block that is bubbling this exception. This is rather difficult to track down especially if you are unfamiliar with the code, I am sharing my procedure in the hopes this saves you time - if you find this helpful drop me a line or follow me on twitter @danielsokolows. This error is caused by unique field constraint on the object, so the first step is to examine the object and locate the API names of all unique fieds. You can do this through SF direclty 'Setup < Customize &lt <object being inserted> &lt Fields' or by downloading the `src/objects` metadata information and searching for <unique>; I preffer the latter and actually download ALL matadata information f…