Invalid or missing intermediate (bundle) certificate

rustyduckmd · November 2, 2021, 3:21am

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is:
mdehr.org

I ran this command:
whynopadlock.com

It produced this output:
You have an invalid or missing intermediate (bundle) certificate. This may not break your padlock on all browsers, but will on others. Please contact your SSL Vendor for assistance with this error.

My web server is (include version):
Apache 2.4.29

The operating system my web server runs on is (include version):
Ubuntu 18.04

My hosting provider, if applicable, is:
DigitalOcean

I can login to a root shell on my machine (yes or no, or I don't know):
yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel):
no

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):
0.31.0

rg305 · November 2, 2021, 3:48am

Hi @rustyduckmd and welcome to the LE community forum

Unfortunately I can't check your IP directly because it was recently block listed - mad fw
That said, if the IP is rather new to you, you might not have to worry to much about system compromise.
But in any event you should review it and have it removed from any block lists:
MultiRBL.valli.org - Results of the query 167.99.148.235

rg305 · November 2, 2021, 3:56am

Using alternate testing systems, I do see the default/long chain in use:

rustyduckmd · November 2, 2021, 2:53pm

Thanks very much for the quick response.

I admit this is not a big area of expertise for me, so I'm a bit fuzzy on your findings, and honestly I'm not sure what is meant by an intermediate certificate. Are you saying that the intermediate certificate is there? If so, is there any reason you can think of for why the whynolock report is showing this error?

Also not sure about the blacklisting, as I'm not familiar with that service. We have had this IP for a while now, so is the blacklisting a cause for concern?

Thanks again!

rg305 · November 2, 2021, 2:56pm

Yes.

Because they need to update their software to compensate for the "multiple root chain" now being provided by LE.

Case in point: If you check their own website URL, they show the same error for themselves.
See: Test Results: whynopadlock.com - Why No Padlock?

Yes, especially if you are expecting to use that IP for outbound emailing.
And also it is a "red flag" warning that your systems may have been used for illicit purposes - compromised or bad actors are operating from within your network/.system.

rustyduckmd · November 2, 2021, 3:21pm

Great explanation, thanks. We'll put the padlock issue on the back burner for now.

As for the blacklist, we don't use our site for outbound emailing, but we'll do a security audit to identify any issues we might have there.

Thanks again for the timely feedback. Very helpful.

system · December 2, 2021, 3:21pm

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.