Timeline for X.509 CA bundle content
Current License: CC BY-SA 4.0
11 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jul 1, 2023 at 19:10 | comment | added | user110148 | I see, thank you very much for your help. | |
| Jul 1, 2023 at 17:18 | comment | added | Maarten Bodewes♦ | It probably has seen and stored the intermediate certificate before, and stored it in an internal cache that you don't get to see. I've seen this situation before, including when troubleshootinger servers for a client. In my opinion they might as well not cache the certs, it would at least not end with misconfigured servers that can serve some clients and not others. Remember that CA's issue multiple certs, so the intermediate CA may be cached from an entirely different connection. | |
| Jul 1, 2023 at 13:12 | comment | added | user110148 | Ok I see, thank you for information. My apache server sends only the end user cert, on my OS I have only the root cert stored (ISRG Root X1), how the web browser manages to validate the full chain and especially the intermediate cert ? | |
| Jul 1, 2023 at 12:43 | comment | added | Maarten Bodewes♦ | Double clicking on the certificate in Windows will give you access to the certificate tree, each of certs can be saved. Of course, that means using the certificate store of Windows not OpenSSL. And you can of course look manually for the root cert. Otherwise you can always enable logging for your TLS sessions or use Wireshark or something like that (in which case TLS 1.2 is easier to use as TLS 1.3 will encrypt the handshake as well). | |
| Jul 1, 2023 at 11:00 | comment | added | user110148 | Is it possible to retrieve the full chain from the end user certificate ? I mean with an openssl command for example | |
| Jul 1, 2023 at 10:53 | comment | added | Maarten Bodewes♦ | Well, the cache is not much use to the end user - you won't find the intermediates in the root store. Apparently 11 years ago the private browsing within Firefox didn't use the intermediate certs apparently, so maybe that will work - or in this case fail. | |
| Jul 1, 2023 at 9:43 | vote | accept | CommunityBot | ||
| Jul 1, 2023 at 9:42 | vote | accept | CommunityBot | ||
| Jul 1, 2023 at 9:42 | |||||
| Jul 1, 2023 at 8:36 | comment | added | user110148 | What I'm currently don't understand is that I'm only providing the end-user certificate without intermediates or root and all my web browsers are able to find the full chain themself. The intermediate certificate in my case is "R3" issued by Let's Encrypt, but in my web browser embedded root certificates or even in my OS, I do not have the R3 certificate. | |
| Jul 1, 2023 at 2:59 | comment | added | dave_thompson_085 | It's almost certainly a mostly-obsolete bridge from LetsEncrypt to IdenTrust/DST, see my comment on the Q. | |
| Jun 30, 2023 at 23:54 | history | answered | Maarten Bodewes♦ | CC BY-SA 4.0 |