Re: Guidance on obtaining certificate chain for Apache SSL setup

--000000000000ca6c910646dc692a
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Fri, Dec 26, 2025 at 4:52=E2=80=AFAM Asma Aljarai <[email protected]=
> wrote:

> Issue:
> I did not receive the certificate chain (intermediate certificates).
> Without the chain, browsers may not fully trust the site, and I want to
> ensure the SSL configuration is complete and secure.
>
> Questions:
> 1. What is the recommended way to obtain the certificate chain from an
> internal CA such as Key Manager Plus?
> 2. Is it acceptable to run Apache securely using only the server
> certificate and private key if the chain is not available?
> 3. Could the missing chain be the reason the site appears as not fully
> secure in browsers?
>

1. You would have to check the documentation for that product. It is
unlikely you will find someone on this list who is familiar with it. More
generally, if you have another website with the same certificate chain, you
can download the chain from your browser.

2. Yes. HTTPD doesn't care about the chain when it is serving requests,
that is the responsibility of the client. HTTPD might need the chain if it
is making subrequests or if it is validating client certificates.

3. Yes, assuming that your browser has the root certificate in its trust
store too.

- Y

--000000000000ca6c910646dc692a
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr">On Fri, Dec 26, 2025 at 4:52=E2=80=AFAM A=
sma Aljarai &lt;<a href=3D"mailto:[email protected]">asmaelgrriy@gmail.=
com</a>&gt; wrote:</div><div class=3D"gmail_quote gmail_quote_container"><b=
lockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-le=
ft:1px solid rgb(204,204,204);padding-left:1ex"><div dir=3D"auto"><div styl=
e=3D"direction:rtl"><div style=3D"direction:ltr" dir=3D"ltr">Issue:</div><d=
iv style=3D"direction:ltr">I did not receive the certificate chain (interme=
diate certificates). Without the chain, browsers may not fully trust the si=
te, and I want to ensure the SSL configuration is complete and secure.</div=
><div style=3D"direction:ltr"><br></div><div style=3D"direction:ltr">Questi=
ons:</div><div style=3D"direction:ltr">1. What is the recommended way to ob=
tain the certificate chain from an internal CA such as Key Manager Plus?</d=
iv><div style=3D"direction:ltr">2. Is it acceptable to run Apache securely =
using only the server certificate and private key if the chain is not avail=
able?</div><div style=3D"direction:ltr">3. Could the missing chain be the r=
eason the site appears as not fully secure in browsers?</div></div></div></=
blockquote><div>=C2=A0</div><div>1. You would have to check the documentati=
on for that product. It is unlikely you will find someone on this list who =
is familiar with it. More generally, if you have another website with the s=
ame certificate chain, you can download the chain from your browser.</div><=
div><br></div><div>2. Yes. HTTPD doesn&#39;t care about the chain when it i=
s serving requests, that is the responsibility=C2=A0of the client. HTTPD mi=
ght need the chain if it is making subrequests or if it is validating clien=
t certificates.</div><div><br></div><div>3. Yes, assuming that your browser=
 has the root certificate in its trust store too.</div><div><br></div><div>=
- Y</div></div></div>

--000000000000ca6c910646dc692a--