708229 - GoDaddy's intermediate CA not in the Mozilla CA bundle

Status: RESOLVED INVALID

(CA Program :: CA Certificate Root Program, task)

Description

[Synthead]

User Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/535.2 (KHTML, like Gecko) Chrome/15.0.874.121 Safari/535.2

Steps to reproduce:

Attempted to use cURL with a webserver configured with a valid GoDaddy class 2 certificate.


Actual results:

The SSL handshake failed due to a missing GoDaddy intermediate CA certificate in cURL's ca-certificates.crt file, provided by the Mozilla CA bundle.


Expected results:

The Mozilla CA certificate bundle is repacked in many Linux distros, such as Arch Linux and Ubuntu, and also used in core functionality packages like ca-certificates (used by cURL) or the Mozilla::CA CPAN Perl module.  This said, the GoDaddy intermediate CA is not included in the Mozilla CA bundle, which causes class 2 certificates from GoDaddy to fail the SSL handshake and be reported as untrusted.

Here is a link to GoDaddy's CA repository: https://certs.godaddy.com/anonymous/repository.seam
The certificate is the third link on the site.  Direct link: http://certificates.godaddy.com/repository/gd_intermediate.crt

Please add this certificate to the bundle.  Doing so will inherently fix the problems with cURL and Mozilla::CA for Arch Linux and Ubuntu (and quite possibly many other packages I haven't found).

Comment 1

[Boris Zbarsky [:bzbarsky]]

Gerv, any idea what this CA bundle thing is and who owns it?  This doesn't seem like a core bug...

Comment 2

[Matthias Versen [:Matti]]

Intermediate certificates aren't included in the "CA bundle". The webserver itself has to send the intermediate certificate along with their own one to complete the certificate chain. Only root certificate are in the Mozilla root store.
The error that you are seeing is a incorrect configured server and you will get the same error in Firefox if you use a Firefox profile that doesn't contain a cached copy of the intermediate certificate.

Btw: Only CA can request an include of an certificated.

This bug report looks invalid

Comment 3

[Gervase Markham [:gerv]]

What Matti said is correct. We do not include intermediate certificates in our root store - there are too many of them and they change too often. All CAs should be advising their customers to put the full certificate chain on their webservers.

Gerv