# Incorrect SSL cert chain build order used/required by nginx 1.3.8?

**URL:** <https://www.ruby-forum.com/t/incorrect-ssl-cert-chain-build-order-used-required-by-nginx-1-3-8/224151>\
**Category:** NGINX\
**Created:** [November 1, 2012, 12:47am UTC](https://www.ruby-forum.com/t/incorrect-ssl-cert-chain-build-order-used-required-by-nginx-1-3-8/224151 "2012-11-01T00:47:58Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![aris](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/258eb7/32.png) [@aris](https://www.ruby-forum.com/u/aris)\
**Post date:** [November 1, 2012, 12:47am UTC](https://www.ruby-forum.com/t/incorrect-ssl-cert-chain-build-order-used-required-by-nginx-1-3-8/224151/1 "2012-11-01T00:47:58Z")

</div>

I’m running nginx/1.3.8 on linux/64.

I’m installing a commercial cert in nginx (Comodo Essential SSL).

When I build the SSL chain in order per instructions from Comodo (Root  
 → Intermediate(s)

[How do I make my own bundle file from CRT files?](https://comodosslstore.com/blog/how-do-i-make-my-own-bundle-file-from-crt-files.html)

I do

cat AddTrustExternalCARoot.crt \> my.domain.com.CHAIN.crt  
cat UTNAddTrustSGCCA.crt \>\> my.domain.com.CHAIN.crt  
cat ComodoUTNSGCCA.crt \>\> my.domain.com.CHAIN.crt  
cat EssentialSSLCA\_2.crt \>\> my.domain.com.CHAIN.crt  
cat STAR\_domain.com.crt \>\> my.domain.com.CHAIN.crt

If use this CHAIN’d cert in my nginx conf,

ssl on;  
ssl\_verify\_client off;  
ssl\_certificate “/path/to/my.domain.com.CHAIN.crt”;  
ssl\_certificate\_key “/path/to/my.domain.com.key”;

and start nginx, it fails,

==\> error.log \<==  
2012/10/31 16:36:44 [emerg] 8666#0:  
SSL\_CTX\_use\_PrivateKey\_file(“/path/to/my.domain.com.key”) failed  
(SSL: error:0B080074:x509 certificate  
routines:X509\_check\_private\_key:key values mismatch)

If I simply switch the cert CHAIN build order, so the personal site crt  
is _first_ to,

- 

```
  cat STAR_domain.com.crt > my.domain.com.CHAIN.crt

```

- 

```
  cat AddTrustExternalCARoot.crt > my.domain.com.CHAIN.crt

```

- 

```
  cat AddTrustExternalCARoot.crt >> my.domain.com.CHAIN.crt

```

cat UTNAddTrustSGCCA.crt \>\> my.domain.com.CHAIN.crt  
cat ComodoUTNSGCCA.crt \>\> my.domain.com.CHAIN.crt  
cat EssentialSSLCA\_2.crt \>\> my.domain.com.CHAIN.crt

- 

```
  cat STAR_domain.com.crt >> my.domain.com.CHAIN.crt

```

then start nginx, it starts correctly, with no error. The site’s  
accessible from most locations.

But a check with

[SSL Server Test (Powered by Qualys SSL Labs)](https://www.ssllabs.com/ssltest/index.html)

returns/reports

“Chain issues Incorrect order”

I’d like to get nginx to accept/use the correct/instructed CHAIN order  
so that it starts-up correctly AND is reported 'correct order; by  
testing sites.

Is this is a config issue on my end – either nginx or the cert build?  
Or a bug?

---

<div class="post-metadata">

**Author:** ![unknown](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/4bbf92/32.png) [@unknown](https://www.ruby-forum.com/u/unknown)\
**Post date:** [November 1, 2012, 6:18am UTC](https://www.ruby-forum.com/t/incorrect-ssl-cert-chain-build-order-used-required-by-nginx-1-3-8/224151/2 "2012-11-01T06:18:03Z")

</div>

On Nov 1, 2012, at 3:47 , [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> ssl\_verify\_client off;
> 
> I’d like to get nginx to accept/use the correct/instructed CHAIN order  
> so that it starts-up correctly AND is reported 'correct order; by  
> testing sites.
> 
> Is this is a config issue on my end – either nginx or the cert build?  
> Or a bug?

> **[Configuring HTTPS servers](http://nginx.org/en/docs/http/configuring_https_servers.html#chains)**
>
> To configure an HTTPS server, the ssl parameter must be enabled on listening sockets in the server block, and the locations of the server certificate and private key files should be specified:

cat STAR\_domain.com.crt EssentialSSLCA\_2.crt ComodoUTNSGCCA.crt  
UTNAddTrustSGCCA.crt AddTrustExternalCARoot.crt \>  
my.domain.com.CHAIN.crt

–  
Igor S.

> **[F5 NGINX: Built for cloud-native apps. Ready for AI traffic.](https://www.f5.com/products/nginx)**
>
> Deliver modern applications with NGINX. Explore high-performance load balancing, API gateways, and web server solutions trusted by top global enterprises.

---

<div class="post-metadata">

**Author:** ![unknown](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/4bbf92/32.png) [@unknown](https://www.ruby-forum.com/u/unknown)\
**Post date:** [November 1, 2012, 8:30am UTC](https://www.ruby-forum.com/t/incorrect-ssl-cert-chain-build-order-used-required-by-nginx-1-3-8/224151/3 "2012-11-01T08:30:40Z")

</div>

Hi,

I use portecle ( [http://portecle.sourceforge.net/](http://portecle.sourceforge.net/) ) to examine ssl  
certificates.

Rgds, Axel

Am 01.11.2012 00:47, schrieb removed\_email\_address@domain.invalid: