SSL cert "err_cert_authority_invalid" on mobile chrome only

Question

Domain: https://www.amz2btc.com

Analysis from SSL Labs: https://www.ssllabs.com/ssltest/analyze.html?d=amz2btc.com

All my desktop browsers open this fine. Mobile Firefox opens this fine. Only when I tried with mobile Chrome did I get the error: err_cert_authority_invalid

I know very little about SSL, so I can't really make sense of the SSL report or why this error is coming up. If someone could ELI5, that would be ideal. :)

Answer 1

I just spent the morning dealing with this. The problem wasn't that I had a certificate missing. It was that I had an extra.

I started out with my ssl.conf containing my server key and three files provided by my SSL certificate authority:

#   Server Certificate: SSLCertificateFile /etc/pki/tls/certs/myserver.cer  #   Server Private Key: SSLCertificateKeyFile /etc/pki/tls/private/myserver.key  #   Server Certificate Chain: SSLCertificateChainFile /etc/pki/tls/certs/AddTrustExternalCARoot.pem  #   Certificate Authority (CA): SSLCACertificateFile /etc/pki/tls/certs/InCommonServerCA.pem 

It worked fine on desktops, but Chrome on Android gave me err_cert_authority_invalid

A lot of headaches, searching and poor documentation later, I figured out that it was the Server Certificate Chain:

SSLCertificateChainFile /etc/pki/tls/certs/AddTrustExternalCARoot.pem 

That was creating a second certificate chain which was incomplete. I commented out that line, leaving me with

#   Server Certificate: SSLCertificateFile /etc/pki/tls/certs/myserver.cer  #   Server Private Key: SSLCertificateKeyFile /etc/pki/tls/private/myserver.key  #   Certificate Authority (CA): SSLCACertificateFile /etc/pki/tls/certs/InCommonServerCA.pem 

and now it's working on Android again. This was on Linux running Apache 2.2.

Answer 2

I had this same problem while hosting a web site via Parse and using a Comodo SSL cert resold by NameCheap.

You will receive two cert files inside of a zip folder: www_yourdomain_com.ca-bundle www_yourdomain_com.crt

You can only upload one file to Parse: Parse SSL Cert Input Box

In terminal combine the two files using:

cat www_yourdomain_com.crt www_yourdomain_com.ca-bundle > www_yourdomain_com_combine.crt 

Then upload to Parse. This should fix the issue with Android Chrome and Firefox browsers. You can verify that it worked by testing it at https://www.sslchecker.com/sslchecker