Quantcast
Channel: Troubleshooting
Viewing all articles
Browse latest Browse all 1814

SSL chain not send by iis. Chain in correct and working on server

$
0
0

I have an iis server running let's encrypt certificates.

My problem is that iis isn't sending the full chain.

If test it with cert util it tell's me chain i ok why isn't iis sending it:

this is the output of certutil:

C:\>certutil -f -urlfetch -verify c:\test.cer
Issuer:
    CN=Let's Encrypt Authority X3
    O=Let's Encrypt
    C=US
  Name Hash(sha1): 7ee66ae7729ab3fcf8a220646c16a12d6071085d
  Name Hash(md5): c0350a4a6f6b94d938b5003a57bb4867
Subject:
    CN=exchange.dikkenberg.net
  Name Hash(sha1): 4f30e29655bd9659d59e782adbc718f53a1ac59e
  Name Hash(md5): b6a452fb8a6fdddda0c01afa2f05fbda
Cert Serial Number: 036b6525c8bfb33446da50997b85c9bf36d0

dwFlags = CA_VERIFY_FLAGS_ALLOW_UNTRUSTED_ROOT (0x1)
dwFlags = CA_VERIFY_FLAGS_IGNORE_OFFLINE (0x2)
dwFlags = CA_VERIFY_FLAGS_FULL_CHAIN_REVOCATION (0x8)
dwFlags = CA_VERIFY_FLAGS_CONSOLE_TRACE (0x20000000)
dwFlags = CA_VERIFY_FLAGS_DUMP_CHAIN (0x40000000)
ChainFlags = CERT_CHAIN_REVOCATION_CHECK_CHAIN (0x20000000)
HCCE_LOCAL_MACHINE
CERT_CHAIN_POLICY_BASE
-------- CERT_CHAIN_CONTEXT --------
ChainContext.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)

SimpleChain.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)

CertContext[0][0]: dwInfoStatus=102 dwErrorStatus=0
  Issuer: CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US
  NotBefore: 26-7-2016 19:39
  NotAfter: 24-10-2016 19:39
  Subject: CN=******
  Serial: 036b6525c8bfb33446da50997b85c9bf36d0
  SubjectAltName: DNS Name=******, DNS Name=******, 
 DNS Name=******, DNS Name=******, DNS Name=******, DNS Name=******, DNS Name=******, DNS Name=******, DNS Name=******, DNS Name=******, DNS Name=******, DNS Name=******
  97c9018be613d951906d34887198f18545db8644
  Element.dwInfoStatus = CERT_TRUST_HAS_KEY_MATCH_ISSUER (0x2)
  Element.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)
  ----------------  Certificate AIA  ----------------
  Verified "Certificate (0)" Time: 0
    [0.0] http://cert.int-x3.letsencrypt.org/

  ----------------  Certificate CDP  ----------------
  No URLs "None" Time: 0
  ----------------  Base CRL CDP  ----------------
  No URLs "None" Time: 0
  ----------------  Certificate OCSP  ----------------
  No Signer "OCSP" Time: 0
    [0.0] http://ocsp.int-x3.letsencrypt.org/

  --------------------------------
    CRL (null):
    Issuer: CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US
    ThisUpdate: 30-7-2016 20:00
    NextUpdate: 6-8-2016 20:00
    ecbecc733dc0d0f0d8f13e57ff88982de445d5d8
  Issuance[0] = 2.23.140.1.2.1
  Issuance[1] = 1.3.6.1.4.1.44947.1.1.1
  Application[0] = 1.3.6.1.5.5.7.3.1 Server Authentication

CertContext[0][1]: dwInfoStatus=102 dwErrorStatus=0
  Issuer: CN=DST Root CA X3, O=Digital Signature Trust Co.
  NotBefore: 17-3-2016 18:40
  NotAfter: 17-3-2021 18:40
  Subject: CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US
  Serial: 0a0141420000015385736a0b85eca708
  cb6c95d597fe6e192d2882339b502d065bb4a3e6
  Element.dwInfoStatus = CERT_TRUST_HAS_KEY_MATCH_ISSUER (0x2)
  Element.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)
  ----------------  Certificate AIA  ----------------
  Verified "Certificate (0)" Time: 4
    [0.0] http://apps.identrust.com/roots/dstrootcax3.p7c

  ----------------  Certificate CDP  ----------------
  Verified "Base CRL (9e)" Time: 0
    [0.0] http://crl.identrust.com/DSTROOTCAX3CRL.crl

  ----------------  Base CRL CDP  ----------------
  No URLs "None" Time: 0
  ----------------  Certificate OCSP  ----------------
  Failed "OCSP" Time: 0
    Error retrieving URL: The operation timed out 0x80072ee2 (INet: 12002 ERROR_
INTERNET_TIMEOUT)
    http://isrg.trustid.ocsp.identrust.com

  --------------------------------
    CRL (null):
    Issuer: E=pki-ops@IdenTrust.com, CN=DST CA X3 OCSP Signer, OU=DST, O=Digital
 Signature Trust, C=US
    ThisUpdate: 2-8-2016 11:51
    NextUpdate: 3-8-2016 11:51
    ec243e50bf0890f22cde404c7776c7305af90fda
  Issuance[0] = 2.23.140.1.2.1
  Issuance[1] = 1.3.6.1.4.1.44947.1.1.1
  Application[0] = 1.3.6.1.5.5.7.3.4 Secure Email
  Application[1] = 1.3.6.1.5.5.7.3.1 Server Authentication

CertContext[0][2]: dwInfoStatus=10c dwErrorStatus=0
  Issuer: CN=DST Root CA X3, O=Digital Signature Trust Co.
  NotBefore: 30-9-2000 23:12
  NotAfter: 30-9-2021 16:01
  Subject: CN=DST Root CA X3, O=Digital Signature Trust Co.
  Serial: 44afb080d6a327ba893039862ef8406b
  137cd76aca382673b15f9394dff6d8544f02c9da
  Element.dwInfoStatus = CERT_TRUST_HAS_NAME_MATCH_ISSUER (0x4)
  Element.dwInfoStatus = CERT_TRUST_IS_SELF_SIGNED (0x8)
  Element.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)
  ----------------  Certificate AIA  ----------------
  No URLs "None" Time: 0
  ----------------  Certificate CDP  ----------------
  No URLs "None" Time: 0
  ----------------  Certificate OCSP  ----------------
  No URLs "None" Time: 0
  --------------------------------
  Application[0] = 1.3.6.1.5.5.7.3.4 Secure Email
  Application[1] = 1.3.6.1.5.5.7.3.1 Server Authentication

Exclude leaf cert:
  9386cd6fddbb5108141e8aa6de02e5076003bca2
Full chain:
  274ef30f8b3ed9c701c5f6bc950782ffbf3927be
------------------------------------
Verified Issuance Policies:
    2.23.140.1.2.1
    1.3.6.1.4.1.44947.1.1.1
Verified Application Policies:
    1.3.6.1.5.5.7.3.1 Server Authentication
Cert is an End Entity certificate
Leaf certificate revocation check passed
CertUtil: -verify command completed successfully.


Viewing all articles
Browse latest Browse all 1814

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>