How do I know if the SSL certificate is perfect?

UNIX for Advanced & Expert Users
1

For about a year and a half, I've been comparing the output of these two commands:

$ openssl rsa -noout -modulus -in /path/to/your/private.key  2> /dev/null | openssl md5
(stdin)= 3a5a1682678d243b6b8337360b55ff10

And

$ openssl x509 -noout -modulus -in /path/to/your/certificate.crt 2> /dev/null | openssl md5
(stdin)= 3a5a1682678d243b6b8337360b55ff10

And checking their output to verify if the chain of certificate is good. LOL. I was wrong.

How do I know what chain is accepted by the server? I had to visit

And generate a certificate chain, then only SSL was reflected properly everywhere. Why is it like that?

2

Well, it's described directly on the site you linked above

What is a Certificate Chain?
The list of SSL certificates, from the root certificate to the end-user certificate,
represents a SSL certificate chain, or intermediate certificate.
These must be installed to a web server along with a primary certificate.
If they aren't installed web browsers will display an "Invalid certificate"
or "certificate not trusted" error.

Afaik, comparing checksums only gives you information about correlation between the last certificate in a chain (end-user certificate) and private key associated with it. It tells nothing about the entire chain.
Here's a bit more elaborated description: What is the SSL Certificate Chain? - DNSimple Help

1 Like
3

All that comparison does is checks to see if the certificate pairs with the private key.

That comparison doesn't have anything to do with the goodness or badness of the certificate (chain). Especially what other clients think of it.

Are you asking how to test if your server utilized your key and certificate pair?

Or are you asking how to test if clients will be happy with the certificate (chain) that your server uses?

Those are two very different things.

I'm not familiar with that tool and will have to check it out at another point in time.

Based on the name and a quick glance, I'm assuming that it takes a PEM encoded certificate and generates a certificate chain from the certificate, through any and all intermediate certificates up to and including the root certificate.

Aside: I'm going to answer this last bit out of order.

As others have indicated, your certificate needs to be trusted by clients using the server using the certificate. Most of the time client's won't trust the certificate directly. They probably won't even trust an intermediate certificate that signed your certificate. They likely will trust a common / well known root certificate that signed the intermediate certificate.

Client's walk the chain of trust backwards from your certificate until they get to a certificate that they trust.

  1. Client's trust Ed.
  2. Ed trusts and vouches for Ned. Thus client's indirectly trust Ned.
  3. Ned trust and vouches for Fred. Thus client's indirectly trust Fred.
  4. Fred trusts and vouches for Ahmed. Thus client's indirectly trust Ahmed.
  5. Ahmed trusts and vouches for Alfred. Thus client's indirectly trust Alfred.

I'm probably one of the few people that will tell you that you don't actually need a full certificate chain if the certificate that signed your certificate is trusted by clients.

You can run the openssl verify (see the man page for details) to validate that the machine you run the command on is happy with your certificate.

If you run the command on your server and it has your intermediate certificate (chain) installed in the proper location (usually somewhere under /etc/ssl) then your certificate without any chain will likely validate. But that's your system and you have the necessary intermediate certificate(s) where your system is able to find them.

The reason that the certificate chain is important is that most systems likely won't have the necessary intermediate certificate(s) on their system. So you can provide them to clients as part of a certificate chain.

As long as you provide enough information to get back to a signing certificate that client's recognize, then they will be able to validate your certificate (chain).

If you are interested in learning more of the concepts (but not math theory) behind things and how to use OpenSSL commands to validate this for yourself, I can highly recommend TLS Mastery by Michael W. Lucas.

1 Like