{"id":234,"date":"2009-09-17T10:45:00","date_gmt":"2009-09-17T18:45:00","guid":{"rendered":"http:\/\/onehub.com\/blog\/posts\/using-godaddy-ssl-certificates-with-nginx"},"modified":"2009-09-17T10:45:00","modified_gmt":"2009-09-17T18:45:00","slug":"using-godaddy-ssl-certificates-with-nginx","status":"publish","type":"post","link":"https:\/\/www.onehub.com\/blog\/2009\/09\/17\/using-godaddy-ssl-certificates-with-nginx\/","title":{"rendered":"Using Godaddy SSL Certificates with NGINX"},"content":{"rendered":"

Have you just installed your new Godaddy certificate into your NGINX web server, and are you finding that some browsers (notably Safari) don’t trust your website when using your Godaddy SSL Certificate?<\/p>\n

This is manifest by the error message “Safari can’t identify the identity of the website ‘your.url.here'” and is caused by the “chain of trust” being incomplete between your certificate and any of the root certificates that your browser client has installed.<\/p>\n

Here’s a quick cure for an NGINX installation:<\/p>\n

Download the gd_bundle.crt and gd_intermediate.crt certificates from Godaddy’s certificate repository<\/a>, then combine them:<\/p>\n

cat yourcert.crt gd_intermediate.crt gd_bundle.crt > yourcert_bundle.crt<\/pre>\n
This concatenates your certificate and the Godaddy intermediate certificates into one file.  Put the file yourcert_bundle.crt in the place that NGINX is looking for your certs (specified in nginx.conf).  Reload your NGINX configuration with:<\/p>\n
kill -HUP <pid of nginx><\/pre>\n
You should be ready to go!  If you want more information on the entire chain of trust, you can download the Godaddy root certificate (gd-class2-root.crt) and use the OpenSSL command utility:<\/p>\n
openssl s_client -CAfile gd-class2-root.crt -connect www.yourdomain.com:443  -verify 10<\/pre>\n
This will pull the certificate from yourdomain.com server, and attempt to verify the chain of trust to whatever root you’ve specified (-CAfile gd-class2-root.crt):<\/p>\n
\nverify depth is 10\nCONNECTED(00000003)\ndepth=2 \/C=US\/O=The Go Daddy Group, Inc.\/OU=Go Daddy Class 2 Certification Authority\nverify return:1\ndepth=1 \/C=US\/ST=Arizona\/L=Scottsdale\/O=GoDaddy.com, Inc.\/OU=http:\/\/certificates.godaddy.com\/repository\/CN=Go Daddy Secure Certification Authority\/serialNumber=07992287\nverify return:1\ndepth=0 \/O=*.yourdomain.com\/OU=Domain Control    Validated\/CN=*.yourdomain.com\nverify return:1\n\u2014-\nCertificate chain\n 0 s:\/O=*.yourdomain.com\/OU=Domain Control Validated\/CN=*.yourdomain.com\n   i:\/C=US\/ST=Arizona\/L=Scottsdale\/O=GoDaddy.com, Inc.\/OU=http:\/\/certificates.godaddy.com\/repository\/CN=Go Daddy Secure Certification Authority\/serialNumber=07992287\n 1 s:\/O=*.yourdomain.com\/OU=Domain Control Validated\/CN=*.yourdomain.com\n   i:\/C=US\/ST=Arizona\/L=Scottsdale\/O=GoDaddy.com, Inc.\/OU=http:\/\/certificates.godaddy.com\/repository\/CN=Go Daddy Secure Certification Authority\/serialNumber=07992287\n 2 s:\/C=US\/ST=Arizona\/L=Scottsdale\/O=GoDaddy.com, Inc.\/OU=http:\/\/certificates.godaddy.com\/repository\/CN=Go Daddy Secure Certification Authority\/serialNumber=07992287\n   i:\/C=US\/O=The Go Daddy Group, Inc.\/OU=Go Daddy Class 2 Certification Authority\n\u2014-\nServer certificate\n<Continued Output>\n<\/pre>\n
This shows that the certificate obtained from the site was verified all the way to a root certificate (specified by -CAfile).<\/p>\n","protected":false},"excerpt":{"rendered":"
Have you just installed your new Godaddy certificate into your NGINX web server, and are you finding that some browsers (notably Safari) don’t trust your website when using your Godaddy SSL Certificate? This is manifest by the error message “Safari […]<\/p>\n","protected":false},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_themeisle_gutenberg_block_has_review":false},"categories":[1],"tags":[],"_links":{"self":[{"href":"https:\/\/www.onehub.com\/blog\/wp-json\/wp\/v2\/posts\/234"}],"collection":[{"href":"https:\/\/www.onehub.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.onehub.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.onehub.com\/blog\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.onehub.com\/blog\/wp-json\/wp\/v2\/comments?post=234"}],"version-history":[{"count":0,"href":"https:\/\/www.onehub.com\/blog\/wp-json\/wp\/v2\/posts\/234\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.onehub.com\/blog\/wp-json\/wp\/v2\/media?parent=234"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.onehub.com\/blog\/wp-json\/wp\/v2\/categories?post=234"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.onehub.com\/blog\/wp-json\/wp\/v2\/tags?post=234"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}