Debug CA certificates issue - DigiCert GlobalRoot CA

Question

There is something wrong, with the way, my Linux machine checks the certificate chain, and I'm unable to debug it

Two hosts, that are currently affected, where i've tested the issue

• repo.fortinet.com (debian/ubuntu repository for apt/deb) ssllabs report
• code.gov.cz (our local gov gitlab instance) ssllabs report

Both have the same issue, according to SSLLabs (server's certificate chain is incomplete, grade capped to "B")

I've verified that DigiCert GlobalRoot CA is correctly installed in my /etc/ssl/certs (both manually configured using dpkg-reconfigure ca-certificates and update-ca-certificates --fresh). I've also verified, that the local serial/fingerprint matches the remote

However i'm unable to connect to these hosts from apt/git, in both cases encountering same symptoms (Certificate verification failed: The certificate is NOT trusted. The certificate issuer is unknown. Could not handshake: Error in the certificate verification.). APT won't download the repo files obviously, git will fail to download the repository.

I've tried to get to the root, using openssl s_client -connect and in both cases OpenSSL reported issue 21 (Verify return code: 21 (unable to verify the first certificate)), full command run is listed below

I've also tried to get the missing intermediates, however that does not resolve the issue.

Is the problem at my side (and I suspect it is) or are both of these servers misconfigured, and I'm simply hitting the security pre-measures in my distro (Debian Buster/Bullseye) ?

Answer 1

If the message from the Qualys SSL Server Test is that the certificate chain is incomplete, then these systems are misconfigured. When sending a certificate chain, you must send each certificate except the root CA. Sending the root CA itself is not required because the client already has it, so while sending it is allowed, you just waste bandwidth doing so.

These servers have sent only the end server certificate. While it is possible to extract the proper certificate chain by using the AIA information in the certificate, TLS libraries don't do so (since it involves making additional network requests). Some web browsers happen to work because they implement certificate caching, but this isn't guaranteed to work there, either. Your system has normal and correct behavior here.

You should notify the administrators of these systems of their misconfiguration and ask them to fix the problem.