Background information for configuring SSL Certificate files correctly.

We regularly see questions about error messages relating to SSL certificate issues - typically that your certificate is not trusted.

In most cases, the root cause is that the certificate file contains only your server's certificate.

Keeping your Certificate Safe

When you receive your certificate files, you will be supplied with a public certificate file.

If you generated your own CSR (Certificate Signing Request), you have the private key file in your hands already; otherwise, the certificate provider will provide you with the private key also.

The private key starts with "-----BEGIN PRIVATE KEY-----" and ends with "-----END PRIVATE KEY-----".

This file, and also any file that may contain this private key, must NEVER be shared with anyone or uploaded anywhere. It must ONLY be configured on the server it is intended to protect.

No legitimate tool or system will ever ask for any private key information.

How It Works

When a client tries to establish an SSL session with a server, the server's certificate must be verified through a chain of trust. From the server, the client receives the public certificate (often called the Leaf Certificate) and a bundle of intermediate certificates. The client will now:

  • Look at the Leaf Certificate, and see it was signed by an intermediate certificate that is higher up the chain
  • That second certificate, in turn, will also be signed by yet another certificate authority that is higher up the chain
  • …until eventually a certificate is reached that is signed by a Root authority.
  • The client looks in its internal store for the Root authority certificate; these root certificates are stored inside Windows, macOs, iOS, and Android
  • If the client finds the root certificate in its store, then the chain is considered valid
  • The client sends a small piece of encrypted data to the server. If the server can decrypt the data, it proves that the server does indeed have the Private Key, and does own the Leaf certificate

Why Certificates Can Appear As Untrusted

Your server presents the Leaf certificate, but clients do not know about every intermediate certificate. Without the intermediate certificate, the client will not be able to verify the chain, and the connection is "untrusted".

Resolution

The server must present the intermediate certificates alongside the leaf certificate. To achieve this, you must ensure that the certificate file you deploy to the server contains not only the leaf certificate, but also the intermediate certificates.

You need to adjust your certificate PEM file using a text editor, and ensure the final format looks like this:

----BEGIN CERTIFICATE-----
[Your Domain/Server (Leaf) Certificate ]
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
[Intermediate CA Certificate]
-----END CERTIFICATE-----

Your certificate file may require additional Intermediate certificates to complete the chain.

File Permissions on Linux

Make sure that your certificate files have the correct permissions after saving them to the correct location:

sudo chown phonesystem:phonesystem /var/lib/3cxpbx/Bin/nginx/conf/Instance1/*.pem
sudo chmod 640 /var/lib/3cxpbx/Bin/nginx/conf/Instance1/*.pem

Where Are My Intermediate Certificates?

Your certificate provider should provide you with any necessary intermediate certificates, and in fact most do provide you with files that you should be able to just "drop-in" to your system.

If for some reason you must recreate them, there are a number of online tools for this; one example is here. Make sure you never upload your private key file.

Note About Root Certificate Inclusion

Most system administrators add the Root certificate to the end of a certificate PEM file for convenience, but do keep in mind the following points:

  • It’s generally unnecessary; the client's store (typically from the Operating System) will have it already pre-installed
  • If the client does not already have the Root certificate, then it should not trust the server, even if it sends a Root certificate
  • If the server sends the Root certificate for every SSL handshake, it adds between 1Kb and 2Kb to every new connection handshake, with no functional benefit

Join the Discussion

Join the discussion in our Forum. Follow us on X and LinkedIn to stay up-to-date on latest news and feature releases.