Why is my SSL certificate untrusted on Android?

Question

The SSL certificate is trusted on most Desktop computers, but only some Android devices. However, even on Android devices where the certificate is untrusted, the root certificate is installed.

I must have tried a hundered ways of resolving this problem, but I think it has something to do with the AddTrust External CA Root (perhaps to do with the SHA-256 fingerprint, which is missing?).

The cause does not appear to be an incorrect Certificate Authority Bundle.
The cause does not appear to be related to time.
All online SSL checker tools I've used (e.g., https://www.ssllabs.com) say the SSL certificate is installed correctly.
The root certificate is located on my Android device and on my Desktop computer (see the SHA1 fingerprint in the two screenshots, which is identical).

EDIT 1

I believe I have included the new intermediary certificate in my certificate chain, but SSL labs is still reporting that it's not present (even after clicking the "Clear cache" button).

EDIT 2

To be explicit about what I've done:

I've signed into to WHM and clicked the "Install an SSL Certificate on a Domain" option.
I've entered the domain name "www.angusaustralia.com.au".
I've entered the IP address "27.124.127.2".
I've entered the certificate issued to me.

I've entered the private key (not listed below).
I've entered the following certificate key chain (many combinations of the below, but I believe this "longer" keychain should work, as per the discussion on the SSLLabs website). This keychain includes the older "USERTrust RSA Certification Authority", which should be trusted by older devices.

Now, it appears as if SSLLabs is caching the old result, because when I clear everything from Chrome on my Mac (from the "beginning of time"), the new certificate chain above is detected, as per my previous edit.

EDIT 3

The answer Michael Hampton gave was correct. However, the reason why the solution he proposed didn't work was because WHM has a bug with updating the certificate authority bundle. When this bug occurs, no matter what text you paste into the Certificate Authority Bundle field (on the SSL/TLS -> Install an SSL Certificate on a Domain page), the contents will be replaced with a different CA bundle despite WHM giving you a success message.

You believe you've added it to your chain, but obviously you haven't. If you actually want help with this, please tell us exactly what you actually did. — Michael Hampton, Jul 27 '16 at 06:17
OK, that _seems_ right. But we can't support cPanel here for a variety of reasons. Your next stop should be cPanel support. — Michael Hampton, Jul 27 '16 at 06:37
Thanks, I'll take it up with them. Trying to get information from the SSL provider was a joke. — magnus, Jul 27 '16 at 06:38

Michael Hampton · Accepted Answer · 2016-07-27T01:36:50.757

33

Your domain's certificate has two paths to two different root certificate authorities.

On modern desktop browsers such as Google Chrome, as well as on newer Android versions, the path being taken is to the more recent USERTrust RSA Certification Authority root certificate. (I get this on Android 7.0 NPD90G.)

On older Android versions, the path being taken is to the older AddTrust External CA Root root certificate.

On this second path, you are missing an intermediate certificate. This is the one shown in the SSL Labs test as an "Extra download". In order to resolve the problem, you need to obtain this intermediate certificate and add it to the certificate chain in your web server.

edited Jul 27 '16 at 01:36

answered Jul 27 '16 at 01:30

Michael Hampton

237,123
42
477
940

This looks like the correct answer. How can I obtain the other intermediate certificate? I downloaded the intermediate CRT file from here (http://crt.usertrust.com/USERTrustRSAAddTrustCA.crt), but it contains binary data rather than the usual "--BEGIN CERTIFICATE ... END CERTIFICATE--" text. – magnus Jul 27 '16 at 02:09
(Note, I obtained that URL from looking at the Authority Information Access section.) – magnus Jul 27 '16 at 02:10
2

That looks like the right intermediate cert, but it looks like it's in binary DER format. I was able to convert it with `openssl x509 -inform der -in USERTrustRSAAddTrustCA.crt -out USERTrustRSAAddTrustCA.pem` – Michael Hampton Jul 27 '16 at 02:22
I must have tried a hundered different configurations, without any luck. I found some useful resources and tried to add the fix you suggested (see https://community.qualys.com/thread/12831). Still no luck. Any further ideas? – magnus Jul 27 '16 at 05:59
7

@user1420752 As previously mentioned, you need to add it to your web server's certificate chain. You haven't done this yet. – Michael Hampton Jul 27 '16 at 06:04
This IS the correct answer. However, see *EDIT 3* above for an explanation on a bug whereby WHM does not allow the updating of the CA bundle, despite reporting that it does. – magnus Jul 27 '16 at 23:09

Why is my SSL certificate untrusted on Android?

1 Answers1

Linked