topic Re: "The server certificate chain is incomplete" SSL Labs VPN validation in General Topics

"The server certificate chain is incomplete" SSL Labs VPN validation

Arnon_Azmon — Wed, 22 Jul 2020 10:54:04 GMT

Hi,

We use a wildcard certificate purchased from a well known CA for our SSL-VPN portal.

When browsing to our VPN site everything's seems OK with the cert and the cert path.

When using SSL-Labs to check our VPN site it gives a score B due to "The server certificate chain is incomplete".

In the certificate path it shows:

Does the "Extra Download" means that that part of the chain isn't in the FW's trusted root?

How should I approach this?

Thank you

Re: "The server certificate chain is incomplete" SSL Labs VPN validation

HristoGrigorov — Wed, 22 Jul 2020 13:17:31 GMT

You need to provide to SSL Labs the whole chain of certificates. The certificate file shall include one after another: Root CA cert + Intermediate certs (if any) + SSL VPN cert. Don't think the order is important...

Re: "The server certificate chain is incomplete" SSL Labs VPN validation

Arnon_Azmon — Wed, 22 Jul 2020 13:58:16 GMT

If I understand you correctly, you mean that the certificate I uploaded to SmartDashboard and use for the VPN portal doesn't include the intermediate cert, which doesn't bother the FW nor the users' browsers, but it does bother the SSL Labs' test?

Re: "The server certificate chain is incomplete" SSL Labs VPN validation

PhoneBoy — Wed, 22 Jul 2020 22:15:05 GMT

What you upload to SmartDashboard should include the relevant certificate as well as all the intermediate certificates.
This is also necessary for some clients as well.

Re: "The server certificate chain is incomplete" SSL Labs VPN validation

HristoGrigorov — Thu, 23 Jul 2020 03:32:53 GMT

( I am sorry for the late reply I am not getting notifications from CheckMates lately for some reason. )

To your question... Yes, what PhoneBoy said, it is best to pack all the chain and upload it to SmartConsole.

Re: "The server certificate chain is incomplete" SSL Labs VPN validation

Arnon_Azmon — Thu, 23 Jul 2020 05:16:24 GMT

OK, thank you both, I'll give it a try and update