root or/and intermediate cerificate not found

[misak35]

When try to add ssl certificate and key on single domain i got error root or/and intermediate cerificate not found. How to fix this?

[misak35]

also, Error: certificate authority not found is got when SSL Certificate Authority / Intermediate (optional) is empty.

[jarland]

There was a bug with OpenSSL that caused this that has been fixed via Vesta patch a while ago. Oddly, I hit the same issue last night though on a new install on CentOS 6.5. I wonder if we're both doing something wrong.

[misak35]

There was a bug with OpenSSL that caused this that has been fixed via Vesta patch a while ago. Oddly, I hit the same issue last night though on a new install on CentOS 6.5. I wonder if we're both doing something wrong.

well how to fix this ?

[jhewit]

Sounds to me like your not putting the certificate bundle information into the "optional" field. On previous testing I found that field is in fact not optional it is required. For go daddy it is the gd_bundle.crt which is basically the certifying authority information.

[jhewit]

Previous topic on this can be found here: http://forum.vestacp.com/viewtopic.php?f=11&t=4020

[jarland]

Sounds to me like your not putting the certificate bundle information into the "optional" field. On previous testing I found that field is in fact not optional it is required. For go daddy it is the gd_bundle.crt which is basically the certifying authority information.

You nailed it for me at least. For the OP, I got my SSL at NameCheap, and here's what I was doing...
SSL certificate: jarland_me.crt
SSL key: (the one I made)
SSL CA: AddTrustExternalCARoot.crt

There was my mistake at the end there. SSL CA should've been PositiveSSLCA2.crt. Make sure you're putting the right thing in the right place.

[misak35]

Sounds to me like your not putting the certificate bundle information into the "optional" field. On previous testing I found that field is in fact not optional it is required. For go daddy it is the gd_bundle.crt which is basically the certifying authority information.

You nailed it for me at least. For the OP, I got my SSL at NameCheap, and here's what I was doing...
SSL certificate: jarland_me.crt
SSL key: (the one I made)
SSL CA: AddTrustExternalCARoot.crt

There was my mistake at the end there. SSL CA should've been PositiveSSLCA2.crt. Make sure you're putting the right thing in the right place.

well on startssl.com, when you register for free, go to Select Certificate Purpose, choose Certificate Target: Web Server SSL/TLS , than Generate Private Key and select domain name eg. subdomain.mydomain.tld (this domain passed Validation Wizard process) this key need to be Decrypt ( openssl rsa -in ssl.key -out ssl.key) ... question is: would it really be decrypted when you put all 3. fields in vesta panel?