blocks|key|1694356|text|在使用Comodo通配符SSL证书时也遇到了同样的问题。在阅读文档后，解决方案是确保在您的配置中包含他们发送给您的证书链文件。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1694357|SSLCertificateChainFile+/etc/ssl/crt/yourSERVERNAME.ca-bundle|code-block|syntax|javascript|1694358|有关Comodo+site的完整详细信息|offset|length|1694359|entityMap|0|LINK|mutability|MUTABLE|url|https://support.comodo.com/index.php?_m=knowledgebase&_a=viewarticle&kbarticleid=264&nav=0,1^0|0|0|2|B|0|0^^$0|@$1|2|3|4|5|6|7|S|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|T|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|U|8|@]|9|@$I|V|J|W|1|X]]|A|$]]|$1|K|3|-4|5|6|7|Y|8|@]|9|@]|A|$]]]|L|$M|$5|N|O|P|A|$Q|R]]]]

Just had the same problem with a Comodo Wildcard SSL cert. After reading the docs the solution is to ensure you include the certificate chain file they send you in your config i.e.

<pre><code>SSLCertificateChainFile /etc/ssl/crt/yourSERVERNAME.ca-bundle
</code></pre>

Full details on <a href="https://support.comodo.com/index.php?_m=knowledgebase&amp;_a=viewarticle&amp;kbarticleid=264&amp;nav=0,1" rel="noreferrer">Comodo site</a>

blocks|key|1479136|text|对于nginx，是否使用以下命令生成链接的crt文件|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1479137|$+cat+www.example.com.crt+bundle.crt+>+www.example.com.chained.crt|code-block|syntax|javascript|1479138|生成的文件应在ssl_certificate指令中使用：|1479139|server+{
++++listen++++++++++++++443+ssl;
++++server_name+++++++++www.example.com;
++++ssl_certificate+++++www.example.com.chained.crt;
++++ssl_certificate_key+www.example.com.key;
++++...
}|1479140|entityMap^0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|M|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|N|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|O|8|@]|9|@]|A|$]]|$1|I|3|J|5|D|7|P|8|@]|9|@]|A|$E|F]]|$1|K|3|-4|5|6|7|Q|8|@]|9|@]|A|$]]]|L|$]]

For nginx do this 
Generate a chained crt file using

<pre><code>$ cat www.example.com.crt bundle.crt &gt; www.example.com.chained.crt
</code></pre>

The resulting file should be used in the ssl_certificate directive:

<pre><code>server {
 listen 443 ssl;
 server_name www.example.com;
 ssl_certificate www.example.com.chained.crt;
 ssl_certificate_key www.example.com.key;
 ...
}
</code></pre>

blocks|key|1479089|text|Firefox比其他浏览器更严格，需要正确安装中间服务器证书。这可以由购买证书的证书颁发机构提供。中间证书通常安装在与服务器证书相同的位置，并且需要httpd.conf文件中的正确条目。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1479090|虽然许多人指责Firefox+(通常)对此进行了排他性的“标记”，但它实际上展示了更高级别的安全标准。|1479091|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|F|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|G|8|@]|9|@]|A|$]]|$1|D|3|-4|5|6|7|H|8|@]|9|@]|A|$]]]|E|$]]

Firefox is more stringent than other browsers and will require proper installation of an intermediate server certificate. This can be supplied by the cert authority the certificate was purchased from. the intermediate cert is typically installed in the same location as the server cert and requires the proper entry in the httpd.conf file.

while many are chastising Firefox for it's (generally) exclusive 'flagging' of this, it's actually demonstrating a higher level of security standards.

blocks|key|1479044|text|我在Firefox和我的服务器上遇到了这个问题。我联系了GoDaddy客户支持，他们让我安装中间服务器证书：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1479045|http://support.godaddy.com/help/article/868/what-is-an-intermediate-certificate|offset|length|1479046|在重新启动万维网发布服务之后，一切都运行得很好。|1479047|如果您没有对服务器的完全访问权限，则必须由ISP为您执行此操作。|1479048|entityMap|0|LINK|mutability|MUTABLE|url^0|0|0|27|0|0|0|0^^$0|@$1|2|3|4|5|6|7|Q|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|R|8|@]|9|@$D|S|E|T|1|U]]|A|$]]|$1|F|3|G|5|6|7|V|8|@]|9|@]|A|$]]|$1|H|3|I|5|6|7|W|8|@]|9|@]|A|$]]|$1|J|3|-4|5|6|7|X|8|@]|9|@]|A|$]]]|K|$L|$5|M|N|O|A|$P|C]]]]

I had this problem with Firefox and my server. I contacted GoDaddy customer support, and they had me install the intermediate server certificate:

<a href="http://support.godaddy.com/help/article/868/what-is-an-intermediate-certificate" rel="nofollow noreferrer">http://support.godaddy.com/help/article/868/what-is-an-intermediate-certificate</a>

After a re-start of the World Wide Web Publishing Service, everything worked perfectly.

If you do not have full access to your server, your ISP will have to do this for you.

blocks|key|1694514|text|如果您从COMODO获得证书，则需要添加此行，该文件位于您收到的zip文件中。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1694515|SSLCertificateChainFile+/path/COMODORSADomainValidationSecureServerCA.crt|code-block|syntax|javascript|1694516|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

If you got your cert from COMODO your need to add
this line, the file is on the zip file you received.

<pre><code>SSLCertificateChainFile /path/COMODORSADomainValidationSecureServerCA.crt
</code></pre>

blocks|key|1694567|text|如果其他任何人在使用Ubuntu灯和"COMODO+Positive+SSL“时遇到此问题，请尝试从压缩文件中的证书构建您自己的包。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1694568|cat+AddTrustExternalCARoot.crt+COMODORSAAddTrustCA.crt+COMODORSADomainValidationSecureServerCA.crt+>+YOURDOMAIN.ca-bundle|offset|length|style|CODE|1694569|entityMap^0|0|0|3D|0^^$0|@$1|2|3|4|5|6|7|J|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|K|8|@$D|L|E|M|F|G]]|9|@]|A|$]]|$1|H|3|-4|5|6|7|N|8|@]|9|@]|A|$]]]|I|$]]

If anyone else is experiencing this issue with an Ubuntu LAMP and "COMODO Positive SSL" try to build your own bundle from the certs in the compressed file.

<code>cat AddTrustExternalCARoot.crt COMODORSAAddTrustCA.crt COMODORSADomainValidationSecureServerCA.crt &gt; YOURDOMAIN.ca-bundle</code>

blocks|key|1479315|text|我一直在绕着Firefox+43，El+Capitan和WHM/cPanel+SSL安装，不断收到不可信站点的错误--我没有买它在最后一个人离开时交给我安装的证书。原来我是安装在错误的域名下，因为我错过了www+-但证书仍然安装在域名上，当我在WHM中使用www.domain.com.au安装证书时，它现在安装的担忧和FF错误已经消失-证书工作良好的www和非www。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1479316|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

I've being going round in circles with Firefox 43, El Capitan and WHM/cPanel SSL installation continually getting the Untrusted site error - I didn't buy the certificate it was handed over to me to install as the last guy walked out the door. Turns out I was installing under the wrong domain because I missed off the www - but the certificate still installed against the domain, when I installed the certificate in WHM using www.domain.com.au it installed now worries and the FF error has gone - the certificate works fine for both www and non-www.

blocks|key|1479400|text|为了回答这个问题的不可重复性方面-+Firefox自动将中间证书导入到其证书库中。因此，如果您以前访问过使用正确配置的证书链使用相同中间证书的站点，则Firefox将存储该证书，这样当您使用相同的中间证书访问具有错误配置的链的站点时，您将不会看到问题。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1479401|你可以在Firefox的证书管理器中查看(选项->隐私和安全->查看证书...)您可以在其中查看所有存储的证书。在“Security+Device”列下，您可以检查证书的来源-自动/手动导入的证书将显示为“Software+Security+Device”，而不是“Builtin+Object+Token”，后者是随Firefox安装的默认设置。您可以删除/不信任任何特定证书，然后再次测试。|1479402|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|F|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|G|8|@]|9|@]|A|$]]|$1|D|3|-4|5|6|7|H|8|@]|9|@]|A|$]]]|E|$]]

To answer the non-reproducability aspect of the question - Firefox automatically imports intermediate certificates into its certificate store. So if you've previously visited a site which has used the same Intermediate Certificate using a correctly configured certificate chain then Firefox will store that Certificate so you will not see the problem when you visit a site that has an incorrectly configured chain using the same Intermediate certificate.

You can check this in Firefox's Certificate Manager (Options->Privacy&amp;Security->View Certificates...) where you can see all stored certificates. Under the 'Security Device' Column you can check where a certificate has come from - automatically/manually imported certificates will appear as from 'Software Security Device' as opposed to the 'Builtin Object Token', which are the default set installed with Firefox. You can delete/Distrust any specific certificates and test again.

My client gets a <code>sec_error_unknown_issuer</code> error message when visiting <a href="https://mediant.ipmail.nl" rel="noreferrer">https://mediant.ipmail.nl</a> with Firefox.
I can't reproduce the error myself. I installed FF on a Vista and a XP machine and had no problems. FF on Ubuntu also works fine.

Does anyone get the same error and does anyone have some clues for me so I can tell my ISP to change some settings?
The certificate is a so called wild-card SSL certificate that works for all subdomains (*.ipmail.nl). Was I wrong to pick the cheapest one?

Firefox and SSL: sec_error_unknown_issuer

服务器

Ubuntu

我的客户在用火狐访问时收到一条sec_error_unknown_issuer错误消息。我自己不能重现这个错误。我在一台Vista和一台XP机器上安装了FF，没有任何问题。Ubuntu上的FF也运行得很好。有没有人遇到同样的错误，有没有人能给我一些线索，让我告诉ISP更改一些设置？该证书是所谓的通配符SSL证书，适用于所有子域(*.ipmail.nl)。我选了最便宜的是不是错了？

问火狐和SSL: sec_error_unknown_issuer
EN

回答 8

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问火狐和SSL: sec_error_unknown_issuerEN

回答 8

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问火狐和SSL: sec_error_unknown_issuer
EN