SSL Certificate Cannot Be Trusted (COMODO) - apache

Question

I am getting the server ready for PCI DSS. There are no other problems but one which I can't solve. PCI scanner (https://www.hackerguardian.com/), says that SSL certificate can't be trusted:
SSL Certificate Cannot Be Trusted 443 / tcp / www
I have removed all other certificates from the chain, leaving only one that was purchased exactly for this server. It was signed by COMODO which is considered as trustworthy. Here is certificate dump:
openssl x509 -in /usr/local/psa/var/certificates/cert-f1nb7M -text -noout
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
e6:3c:e1:95:56:07:3c:f7:4c:5e:b3:bd:06:6d:37:f0
Signature Algorithm: sha256WithRSAEncryption
Issuer: C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO RSA Extended Validation Secure Server CA
Validity
Not Before: Nov 17 00:00:00 2015 GMT
Not After : Dec 3 23:59:59 2017 GMT
Subject: serialNumber=04045342/1.3.6.1.4.1.311.60.2.1.3=GB/businessCategory=Private Organization, C=GB/postalCode=BN27 2BY,
ST=East Sussex, L=Hailsham/street=Station Road/street=Unit 10 Swan Business Centre, O=Fuss 3 Solutions Ltd,
OU=COMODO EV SSL, CN=www.fuss3inkandtoner.co.uk
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:
...................
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Authority Key Identifier:
keyid:39:DA:FF:CA:28:14:8A:A8:74:13:08:B9:E4:0E:A9:D2:FA:7E:9D:69
X509v3 Subject Key Identifier:
D1:C0:72:40:F1:A4:47:A6:FF:32:C4:56:6F:EF:F5:1E:40:6A:72:DC
X509v3 Key Usage: critical
Digital Signature, Key Encipherment
X509v3 Basic Constraints: critical
CA:FALSE
X509v3 Extended Key Usage:
TLS Web Server Authentication, TLS Web Client Authentication
X509v3 Certificate Policies:
Policy: 1.3.6.1.4.1.6449.1.2.1.5.1
CPS: https://secure.comodo.com/CPS
X509v3 CRL Distribution Points:
Full Name:
URI:http://crl.comodoca.com/COMODORSAExtendedValidationSecureServerCA.crl
Authority Information Access:
CA Issuers - URI:http://crt.comodoca.com/COMODORSAExtendedValidationSecureServerCA.crt
OCSP - URI:http://ocsp.comodoca.com
X509v3 Subject Alternative Name:
DNS:www.fuss3inkandtoner.co.uk, DNS:fuss3inkandtoner.co.uk
1.3.6.1.4.1.11129.2.4.2:
............
Signature Algorithm: sha256WithRSAEncryption
...............
Certificate is real, it is not expired and domain matches. I have tried other online diagnostic tools like https://www.ssllabs.com/ssltest/analyze.html?d=fuss3inkandtoner.co.uk and everyone says that certificate is good. Everyone but hackersguardian.com which I need to pass for PCI Compliance.
I am not a sysadmin and this certificate was installed by someone else (I think hosting support's sysadmin). I need your advise on how to solve this problem. Thank you in advance.

Answer 1

It was a false positive. Its a very strange thing when security scanner from COMODO (hackerguardian.com) reports a bad certificate issued by COMODO (!).

Answer 2

This tool will clarify the issue you have: https://decoder.link/sslchecker/?hostname=www.hackerguardian.com&port=443
CA bundle installed along with the certificate is malformed (incorrect order). The certificate itself is good and valid, however its validity cannot be verified against the CA bundle, thus it is expected.
here is the correct one bundle: http://helpdesk.ssls.com/hc/en-us/article_attachments/201576002/COMODO_OV_SHA-256_bundle.crt
You can pass that to your hosting so they can reinstall that for you. After that,all will be ok. trust me :)