I have received a p7b file from a bank which should be a signed certificate, as a response to a csr file that I have sent.
I have manged to extract a pem certificate with the following command:
openssl pkcs7 -print_certs -in certificate.p7b -out certificate.crt
The certificate.crt file that I extracted has the following structure:
subject=/C=MK/ST=// ......
issuer=/CN=XXX
-----BEGIN CERTIFICATE-----
.
.
.
-----END CERTIFICATE-----
subject=/CN=XXX
issuer=/CN=XXX
-----BEGIN CERTIFICATE-----
.
.
.
-----END CERTIFICATE-----
I am not an expert on SSL, but I assume that this is a certificate chain, since it has two certificates.
I have configured apache with the following directives:
SSLEngine on
SSLCertificateFile path/to/certs/certificate.crt
SSLCertificateChainFile path/to/certs/certificate.crt
SSLCertificateKeyFile path/to/certs/private.key
Apache serves this properly on https, but the browser does not recognize this as a signed certificate, and gives me that Untrusted connection screen.
Am I doing something wrong, or the certificate is not signed by a trusted authority... Is there a way to check if the certificate is signed properly?
You may use the SSL configuration checker if the certificate was installed properly, refer to the link below:
http://www.sslshopper.com/ssl-checker.html
or
https://sslcheck.globalsign.com/en_US
You may also use this link to check who issued the certificate and details of the certificate:
http://www.sslshopper.com/certificate-decoder.html
Related
I am facing issue at vestacp: during pass the
SSL Certificate:
-----BEGIN CERTIFICATE-----
b5XsfsteyPAX9uLwiTctWC4TO9UsnjWKx2ZBt8q4WgQ5nrmkXUwv
-----END CERTIFICATE-----
SSL Key:
-----BEGIN RSA PRIVATE KEY-----
OOTW0NwF+ENrko9JHyLGZPOrk1w/+DElPHYZWMRXB/SJIsvehu/lgMpEEGgT
-----END RSA PRIVATE KEY-----
i have already checked my certificate result this link: https://decoder.link/
it show me my certificate is valid.
You should do the following:
In the SSL Certificate field:
Paste the contents of the certificate issued to your domain. In windows you can usually verify this by simply double clicking (or opening) the .crt file. A window will pop-up with information about the certificate. Just check under "Issued to:" and make sure its issued to your domain.
In the SSL Key field
Paste the contents of the key that was created during the generation of the csr. It usually begins with -----BEGIN RSA PRIVATE KEY-----
In the SSL Certificate Authority/Intermediate
Paste the contents of the CA bundle certificate you received from your CA. That is the certificate without your domain name under "Issued to:" as explained in step 1.
Hope this helps someone. You can also read https://support.dnsimple.com/articles/what-is-ssl-certificate-chain/ to understand certificate chains.
I'm trying to set up a SSL certificate on a site using nginx web server. In the past, I generated SSL certs from Let's Encrypt/Certbot with no issues. This time, I purchased a .com domain and a Positive SSL certificate from MyDomain.com. MyDomain.com doesn't provide a .zip file or ca-bundle file for the cert (i.e., there doesn't appear to be an intermediate certificate or root certificate). Instead, it gives me two plaintext lines of code to manually copy: one for Certificate and one for Key.
The Certificate line contains -----BEGIN CERTIFICATE----- and -----END CERTIFICATE-----
The Key line contains -----BEGIN RSA PRIVATE KEY----- and -----END RSA PRIVATE KEY-----
I paste each of these lines into its own text editor file (using Atom on Ubuntu 18.0) and save as .crt and .key, respectively. (I was told by MyDomain.com support that the Certificate should be .crt, but who knows?)
I then add these file paths to my nginx site config file as below:
ssl_certificate /etc/ssl/certs/mysite.com.crt;
ssl_certificate_key /etc/ssl/private/mysite.com.key;
However, nginx fails on restart and when I check the config file I get the following:
$ sudo nginx -t
nginx: [emerg] PEM_read_bio_X509_AUX("/etc/ssl/certs/mysite.com.crt") failed (SSL: error:0909006C:PEM routines:get_name:no start line:Expecting: TRUSTED CERTIFICATE)
nginx: configuration file /etc/nginx/nginx.conf test failed
Some things I've tried:
Saving the Certificate as a .pem = same error.
Manually adding the word TRUSTED to the certificate's beginning and ending = same error.
Trying to convert the file based on its encoding:
$ sudo openssl x509 -in /etc/ssl/certs/mysite.com.crt -out /etc/ssl/certs/mysite.com.pem -outform PEM
unable to load certificate
140561005191616:error:0909006C:PEM routines:get_name:no start line:../crypto/pem/pem_lib.c:745:Expecting: TRUSTED CERTIFICATE
$ sudo openssl x509 -in /etc/ssl/certs/mysite.com.crt -inform der -outform pem -out /etc/ssl/certs/mysite.com.pem
unable to load certificate
139831375835584:error:0D0680A8:asn1 encoding routines:asn1_check_tlen:wrong tag:../crypto/asn1/tasn_dec.c:1130:
139831375835584:error:0D07803A:asn1 encoding routines:asn1_item_embed_d2i:nested asn1 error:../crypto/asn1/tasn_dec.c:290:Type=X509
$ sudo openssl x509 -inform DER -in /etc/ssl/certs/mysite.com.crt -out /etc/ssl/certs/mysite.com.pem -text
unable to load certificate
139993835831744:error:0D0680A8:asn1 encoding routines:asn1_check_tlen:wrong tag:../crypto/asn1/tasn_dec.c:1130:
139993835831744:error:0D07803A:asn1 encoding routines:asn1_item_embed_d2i:nested asn1 error:../crypto/asn1/tasn_dec.c:290:Type=X509
I'm not sure what to do from here. Has anyone successfully installed a SSL certificate on nginx using just a .crt file and .key file?
Should anyone see this and feel curious, I had to reach out to MyDomain.com support and ask for the certificate bundle. They got it to me (.crtc bundle as well as individual files for cert and intermediate cert) and now it works just fine on my nginx server. It wasn't going to work without those additional files.
I requested a certificate from godaddy and I received 3 files.
a5daacfb38e03863.crt
gd_bundle-g2-g1.crt
gdig2.crt.pem
I am about to install it in my tomcat 8.
But I am not sure where is the root, intermediate or issued SSL cert.
I checked the gd_bundle-g2-g1.crt, It has 3 certificates:
And I noticed that the first one is thesame as gdig2.crt.pem (first one shown below)
-----BEGIN CERTIFICATE-----
MIIE0DCCA7igAwIBAgIBBzANBgkqhkiG9w0BAQsFADCBgzELMAkGA1UEBhMCVVMx
EDAOBgNVBAgTB0FyaXpvbmExEzARBgNVBAcTClNjb3R0c2RhbGUxGjAYBgNVBAoT
EUdvRGFkZHkuY29tLCBJbmMuMTEwLwYDVQQDEyhHbyBEYWRkeSBSb290IENlcnRp
ZmljYXRlIEF1dGhvcml0eSAtIEcyMB4XDTExMDUwMzA3MDAwMFoXDTMxMDUwMzA3
MDAwMFowgbQxCzAJBgNVBAYTAlVTMRAwDgYDVQQIEwdBcml6b25hMRMwEQYDVQQH
EwpTY290dHNkYWxlMRowGAYDVQQKExFHb0RhZGR5LmNvbSwgSW5jLjEtMCsGA1UE
CxMkaHR0cDovL2NlcnRzLmdvZGFkZHkuY29tL3JlcG9zaXRvcnkvMTMwMQYDVQQD
EypHbyBEYWRkeSBTZWN1cmUgQ2VydGlmaWNhdGUgQXV0aG9yaXR5IC0gRzIwggEi
MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC54MsQ1K92vdSTYuswZLiBCGzD
BNliF44v/z5lz4/OYuY8UhzaFkVLVat4a2ODYpDOD2lsmcgaFItMzEUz6ojcnqOv
K/6AYZ15V8TPLvQ/MDxdR/yaFrzDN5ZBUY4RS1T4KL7QjL7wMDge87Am+GZHY23e
cSZHjzhHU9FGHbTj3ADqRay9vHHZqm8A29vNMDp5T19MR/gd71vCxJ1gO7GyQ5HY
pDNO6rPWJ0+tJYqlxvTV0KaudAVkV4i1RFXULSo6Pvi4vekyCgKUZMQWOlDxSq7n
eTOvDCAHf+jfBDnCaQJsY1L6d8EbyHSHyLmTGFBUNUtpTrw700kuH9zB0lL7AgMB
AAGjggEaMIIBFjAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNV
HQ4EFgQUQMK9J47MNIMwojPX+2yz8LQsgM4wHwYDVR0jBBgwFoAUOpqFBxBnKLbv
9r0FQW4gwZTaD94wNAYIKwYBBQUHAQEEKDAmMCQGCCsGAQUFBzABhhhodHRwOi8v
b2NzcC5nb2RhZGR5LmNvbS8wNQYDVR0fBC4wLDAqoCigJoYkaHR0cDovL2NybC5n
b2RhZGR5LmNvbS9nZHJvb3QtZzIuY3JsMEYGA1UdIAQ/MD0wOwYEVR0gADAzMDEG
CCsGAQUFBwIBFiVodHRwczovL2NlcnRzLmdvZGFkZHkuY29tL3JlcG9zaXRvcnkv
MA0GCSqGSIb3DQEBCwUAA4IBAQAIfmyTEMg4uJapkEv/oV9PBO9sPpyIBslQj6Zz
91cxG7685C/b+LrTW+C05+Z5Yg4MotdqY3MxtfWoSKQ7CC2iXZDXtHwlTxFWMMS2
RJ17LJ3lXubvDGGqv+QqG+6EnriDfcFDzkSnE3ANkR/0yBOtg2DZ2HKocyQetawi
DsoXiWJYRBuriSUBAA/NxBti21G00w9RKpv0vHP8ds42pM3Z2Czqrpv1KrKQ0U11
GIo/ikGQI31bS/6kA1ibRrLDYGCD+H1QQc7CoZDDu+8CL9IVVO5EFdkKrqeKM+2x
LXY2JtwE65/3YR8V3Idv7kaWKK2hJn0KCacuBKONvPi8BDAB
-----END CERTIFICATE-----
I'm using RapidSSL with apache2 (2.2.22-13+deb7u6). I got three files from rapidssl - public.crt, private.key and rapid_intermediate.crt.
My public.crt looks like
-----BEGIN CERTIFICATE-----
MIIErjCCA5agAwIBAgIDBthaMA0GCSqSAwHgYDVQQDExdSYXBpZFNTTCBTSEEy
NTYgQ0EgLSBHMzAeFw0xNTA5MTAwMDU0NTJaFw0xNjA5MTExNTM1NTNaMIGTMRMw
EQYDVQQLEwpHVDM5ODg2NjMwMTEwLwYDVQQLEyhTZWUgd3d3LnJhcGlkc3NsLmNv
bS9yZXNvdXJjZXMvY3BzIChjKTE1MS8wLQYDVQQLEyZLm1lbG9tYXAuY29t
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvDo9jDb+k/dHqp7FW7dW
V9+W6a1Ut3OKC3wCulac+WG2roxZukuA42LQ4fAY/BDtBkk2UQ5IyFpFzmCiXjBu
...
-----END CERTIFICATE-----
My private.key looks like
-----BEGIN RSA PRIVATE KEY-----
MdddddIBAAKCAQEAvDo9jDb+k/dHqp7FW7dddddddddPvuSy2aEJcHbt2kb6UI
ddddddd7dWVQ84DlVPvuSy2aEJcHbt2kb6UIdddddddddAKCAQEAvDMIIEowIB
...
-----END RSA PRIVATE KEY-----
My RapidSSL intermediate looks like
-----BEGIN CERTIFICATE-----
MIIEZZZZZZZgAwIBAgIDAjp3MA0GCSqGSIb3DQEBCwUAMEIxCzAJBgNVBAYTAlVT
MRYwFAYSSSSSSS1HZW9UcnVzdCBJbmMuMRswGQYDVQQSSSSSZW9UcnVzdCBHbG9i
YWwgQ0EwHhcNMTQwODI5MjEzOTMyWhcNMjIwNTIwMjEzOTMyWjBHMQswCQYDVQQG
EwJVUzEWMBQGA1UEChMNR2VvVHJ1c3QgSW5jLjEgMB4GA1UEAxMXUmFwaWRTU0wg
...
-----END CERTIFICATE-----
In my apache config,
SSLEngine on
SSLCertificateFile /etc/apache2/ssl/crt/public.crt
SSLCertificateKeyFile /etc/apache2/ssl/private/private.key
SSLCertificateChainFile /etc/apache2/ssl/crt/rapid_intermediate.crt
However, I'm still getting the following errors.
unable to get local issuer certificate
certificate not trusted
unable to verify the first certificate
Please let me know what I did wrong.
Thank you.
Check the chain order, sometimes the chain is unsorted or need an additional certificate in chain, if you server is public you can use sslchecker.com to check
This is basically a follow up to this question. After buying a Comodo SSL Certificate, I was also only sent two files in a zip folder - fake_domain.crt and fake_domain.ca-bundle. Most references I have seen say that I should have received 4 files, such as COMODORSADomainValidationSecureServerCA.crt.
To upload my SSL cert onto the AWS load balancer, it requires the Private Key, Public Key Certificate and Certificate Chain, all in PEM format. The private key and cert are simple enough. For the chain, using the answer from the referred question -
cat certfile.crt bundle.ca-bundle >> chain.crt
did not work. AWS responded with the following error:
Error creating certificate
Unable to validate certificate chain. The certificate chain must start with the immediate signing certificate, followed by any intermediaries in order. The index within the chain of the invalid certificate is: 1
Converting both of the files to PEM format and THEN concatenating also failed. This was the command I used and then copied the output into AWS Certificate Chain field:
openssl x509 -inform PEM -in fake_domain.crt; openssl x509 -inform PEM -in fake_domain.ca-bundle
How do I create the Certificate Chain correctly for AWS load balancers?
Certificate Chain is determined by certificate type that you buy. If you buy ssl certificate from Comodo they will send .crt and .key files which are Certificate body and Certificate Private Key.
Certificate Chain is not related with that file. You can take certificate chain file from Comodo for your ssl type. For example, if you buy ositiveSSL / EssentialSSL SHA-256 from Comodo, you need to verify your certificate with certificate chain below:
-----BEGIN CERTIFICATE-----
MIIGCDCCA/CgAwIBAgIQKy5u6tl1NmwUim7bo3yMBzANBgkqhkiG9w0BAQwFADCB
hTELMAkGA1UEBhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4G
A1UEBxMHU2FsZm9yZDEaMBgGA1UEChMRQ09NT0RPIENBIExpbWl0ZWQxKzApBgNV
BAMTIkNPTU9ETyBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTQwMjEy
MDAwMDAwWhcNMjkwMjExMjM1OTU5WjCBkDELMAkGA1UEBhMCR0IxGzAZBgNVBAgT
EkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9yZDEaMBgGA1UEChMR
Q09NT0RPIENBIExpbWl0ZWQxNjA0BgNVBAMTLUNPTU9ETyBSU0EgRG9tYWluIFZh
bGlkYXRpb24gU2VjdXJlIFNlcnZlciBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEP
ADCCAQoCggEBAI7CAhnhoFmk6zg1jSz9AdDTScBkxwtiBUUWOqigwAwCfx3M28Sh
bXcDow+G+eMGnD4LgYqbSRutA776S9uMIO3Vzl5ljj4Nr0zCsLdFXlIvNN5IJGS0
Qa4Al/e+Z96e0HqnU4A7fK31llVvl0cKfIWLIpeNs4TgllfQcBhglo/uLQeTnaG6
ytHNe+nEKpooIZFNb5JPJaXyejXdJtxGpdCsWTWM/06RQ1A/WZMebFEh7lgUq/51
UHg+TLAchhP6a5i84DuUHoVS3AOTJBhuyydRReZw3iVDpA3hSqXttn7IzW3uLh0n
c13cRTCAquOyQQuvvUSH2rnlG51/ruWFgqUCAwEAAaOCAWUwggFhMB8GA1UdIwQY
MBaAFLuvfgI9+qbxPISOre44mOzZMjLUMB0GA1UdDgQWBBSQr2o6lFoL2JDqElZz
30O0Oija5zAOBgNVHQ8BAf8EBAMCAYYwEgYDVR0TAQH/BAgwBgEB/wIBADAdBgNV
HSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwGwYDVR0gBBQwEjAGBgRVHSAAMAgG
BmeBDAECATBMBgNVHR8ERTBDMEGgP6A9hjtodHRwOi8vY3JsLmNvbW9kb2NhLmNv
bS9DT01PRE9SU0FDZXJ0aWZpY2F0aW9uQXV0aG9yaXR5LmNybDBxBggrBgEFBQcB
AQRlMGMwOwYIKwYBBQUHMAKGL2h0dHA6Ly9jcnQuY29tb2RvY2EuY29tL0NPTU9E
T1JTQUFkZFRydXN0Q0EuY3J0MCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5jb21v
ZG9jYS5jb20wDQYJKoZIhvcNAQEMBQADggIBAE4rdk+SHGI2ibp3wScF9BzWRJ2p
mj6q1WZmAT7qSeaiNbz69t2Vjpk1mA42GHWx3d1Qcnyu3HeIzg/3kCDKo2cuH1Z/
e+FE6kKVxF0NAVBGFfKBiVlsit2M8RKhjTpCipj4SzR7JzsItG8kO3KdY3RYPBps
P0/HEZrIqPW1N+8QRcZs2eBelSaz662jue5/DJpmNXMyYE7l3YphLG5SEXdoltMY
dVEVABt0iN3hxzgEQyjpFv3ZBdRdRydg1vs4O2xyopT4Qhrf7W8GjEXCBgCq5Ojc
2bXhc3js9iPc0d1sjhqPpepUfJa3w/5Vjo1JXvxku88+vZbrac2/4EjxYoIQ5QxG
V/Iz2tDIY+3GH5QFlkoakdH368+PUq4NCNk+qKBR6cGHdNXJ93SrLlP7u3r7l+L4
HyaPs9Kg4DdbKDsx5Q5XLVq4rXmsXiBmGqW5prU5wfWYQ//u+aen/e7KJD2AFsQX
j4rBYKEMrltDR5FL1ZoXX/nUh8HCjLfn4g8wGTeGrODcQgPmlKidrv0PJFGUzpII
0fxQ8ANAe4hZ7Q7drNJ3gjTcBpUC2JD5Leo31Rpg0Gcg19hCC0Wvgmje3WYkN5Ap
lBlGGSW4gNfL1IYoakRwJiNiqZ+Gb7+6kHDSVneFeO/qJakXzlByjAA6quPbYzSf
+AZxAeKCINT+b72x
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIFdDCCBFygAwIBAgIQJ2buVutJ846r13Ci/ITeIjANBgkqhkiG9w0BAQwFADBv
MQswCQYDVQQGEwJTRTEUMBIGA1UEChMLQWRkVHJ1c3QgQUIxJjAkBgNVBAsTHUFk
ZFRydXN0IEV4dGVybmFsIFRUUCBOZXR3b3JrMSIwIAYDVQQDExlBZGRUcnVzdCBF
eHRlcm5hbCBDQSBSb290MB4XDTAwMDUzMDEwNDgzOFoXDTIwMDUzMDEwNDgzOFow
gYUxCzAJBgNVBAYTAkdCMRswGQYDVQQIExJHcmVhdGVyIE1hbmNoZXN0ZXIxEDAO
BgNVBAcTB1NhbGZvcmQxGjAYBgNVBAoTEUNPTU9ETyBDQSBMaW1pdGVkMSswKQYD
VQQDEyJDT01PRE8gUlNBIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MIICIjANBgkq
hkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAkehUktIKVrGsDSTdxc9EZ3SZKzejfSNw
AHG8U9/E+ioSj0t/EFa9n3Byt2F/yUsPF6c947AEYe7/EZfH9IY+Cvo+XPmT5jR6
2RRr55yzhaCCenavcZDX7P0N+pxs+t+wgvQUfvm+xKYvT3+Zf7X8Z0NyvQwA1onr
ayzT7Y+YHBSrfuXjbvzYqOSSJNpDa2K4Vf3qwbxstovzDo2a5JtsaZn4eEgwRdWt
4Q08RWD8MpZRJ7xnw8outmvqRsfHIKCxH2XeSAi6pE6p8oNGN4Tr6MyBSENnTnIq
m1y9TBsoilwie7SrmNnu4FGDwwlGTm0+mfqVF9p8M1dBPI1R7Qu2XK8sYxrfV8g/
vOldxJuvRZnio1oktLqpVj3Pb6r/SVi+8Kj/9Lit6Tf7urj0Czr56ENCHonYhMsT
8dm74YlguIwoVqwUHZwK53Hrzw7dPamWoUi9PPevtQ0iTMARgexWO/bTouJbt7IE
IlKVgJNp6I5MZfGRAy1wdALqi2cVKWlSArvX31BqVUa/oKMoYX9w0MOiqiwhqkfO
KJwGRXa/ghgntNWutMtQ5mv0TIZxMOmm3xaG4Nj/QN370EKIf6MzOi5cHkERgWPO
GHFrK+ymircxXDpqR+DDeVnWIBqv8mqYqnK8V0rSS527EPywTEHl7R09XiidnMy/
s1Hap0flhFMCAwEAAaOB9DCB8TAfBgNVHSMEGDAWgBStvZh6NLQm9/rEJlTvA73g
JMtUGjAdBgNVHQ4EFgQUu69+Aj36pvE8hI6t7jiY7NkyMtQwDgYDVR0PAQH/BAQD
AgGGMA8GA1UdEwEB/wQFMAMBAf8wEQYDVR0gBAowCDAGBgRVHSAAMEQGA1UdHwQ9
MDswOaA3oDWGM2h0dHA6Ly9jcmwudXNlcnRydXN0LmNvbS9BZGRUcnVzdEV4dGVy
bmFsQ0FSb290LmNybDA1BggrBgEFBQcBAQQpMCcwJQYIKwYBBQUHMAGGGWh0dHA6
Ly9vY3NwLnVzZXJ0cnVzdC5jb20wDQYJKoZIhvcNAQEMBQADggEBAGS/g/FfmoXQ
zbihKVcN6Fr30ek+8nYEbvFScLsePP9NDXRqzIGCJdPDoCpdTPW6i6FtxFQJdcfj
Jw5dhHk3QBN39bSsHNA7qxcS1u80GH4r6XnTq1dFDK8o+tDb5VCViLvfhVdpfZLY
Uspzgb8c8+a4bmYRBbMelC1/kZWSWfFMzqORcUx8Rww7Cxn2obFshj5cqsQugsv5
B5a6SE2Q8pTIqXOi6wZ7I53eovNNVZ96YUWYGGjHXkBrI/V5eu+MtWuLt29G9Hvx
PUsE2JOAWVrgQSQdso8VYFhH2+9uRv0V9dlfmrPb2LjkQLPNlzmuhbsdjrzch5vR
pu/xO28QOG8=
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIENjCCAx6gAwIBAgIBATANBgkqhkiG9w0BAQUFADBvMQswCQYDVQQGEwJTRTEU
MBIGA1UEChMLQWRkVHJ1c3QgQUIxJjAkBgNVBAsTHUFkZFRydXN0IEV4dGVybmFs
IFRUUCBOZXR3b3JrMSIwIAYDVQQDExlBZGRUcnVzdCBFeHRlcm5hbCBDQSBSb290
MB4XDTAwMDUzMDEwNDgzOFoXDTIwMDUzMDEwNDgzOFowbzELMAkGA1UEBhMCU0Ux
FDASBgNVBAoTC0FkZFRydXN0IEFCMSYwJAYDVQQLEx1BZGRUcnVzdCBFeHRlcm5h
bCBUVFAgTmV0d29yazEiMCAGA1UEAxMZQWRkVHJ1c3QgRXh0ZXJuYWwgQ0EgUm9v
dDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALf3GjPm8gAELTngTlvt
H7xsD821+iO2zt6bETOXpClMfZOfvUq8k+0DGuOPz+VtUFrWlymUWoCwSXrbLpX9
uMq/NzgtHj6RQa1wVsfwTz/oMp50ysiQVOnGXw94nZpAPA6sYapeFI+eh6FqUNzX
mk6vBbOmcZSccbNQYArHE504B4YCqOmoaSYYkKtMsE8jqzpPhNjfzp/haW+710LX
a0Tkx63ubUFfclpxCDezeWWkWaCUN/cALw3CknLa0Dhy2xSoRcRdKn23tNbE7qzN
E0S3ySvdQwAl+mG5aWpYIxG3pzOPVnVZ9c0p10a3CitlttNCbxWyuHv77+ldU9U0
WicCAwEAAaOB3DCB2TAdBgNVHQ4EFgQUrb2YejS0Jvf6xCZU7wO94CTLVBowCwYD
VR0PBAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wgZkGA1UdIwSBkTCBjoAUrb2YejS0
Jvf6xCZU7wO94CTLVBqhc6RxMG8xCzAJBgNVBAYTAlNFMRQwEgYDVQQKEwtBZGRU
cnVzdCBBQjEmMCQGA1UECxMdQWRkVHJ1c3QgRXh0ZXJuYWwgVFRQIE5ldHdvcmsx
IjAgBgNVBAMTGUFkZFRydXN0IEV4dGVybmFsIENBIFJvb3SCAQEwDQYJKoZIhvcN
AQEFBQADggEBALCb4IUlwtYj4g+WBpKdQZic2YR5gdkeWxQHIzZlj7DYd7usQWxH
YINRsPkyPef89iYTx4AWpb9a/IfPeHmJIZriTAcKhjW88t5RxNKWt9x+Tu5w/Rw5
6wwCURQtjr0W4MHfRnXnJK3s9EK0hZNwEGe6nQY1ShjTK3rMUUKhemPR5ruhxSvC
Nr4TDea9Y355e6cJDUCrat2PisP29owaQgVR1EX1n6diIWgVIEM8med8vSTYqZEX
c4g/VhsxOBi0cQ+azcgOno4uG+GMmIPLHzHxREzGBHNJdmAPx/i9F4BrLunMTA5a
mnkPIAou1Z5jJh5VkpTYghdae9C8x49OhgQ=
-----END CERTIFICATE-----
I've copied it from https://www.ssl2buy.com/wiki/comodo-positivessl-essentialssl-sha-2-ca-bundle. You can find appropriate certificate chain for your ssl certificate.