{"action":"created","issue":{"url":"https://api.github.com/repos/OpenTreeOfLife/opentree/issues/553","labels_url":"https://api.github.com/repos/OpenTreeOfLife/opentree/issues/553/labels{/name}","comments_url":"https://api.github.com/repos/OpenTreeOfLife/opentree/issues/553/comments","events_url":"https://api.github.com/repos/OpenTreeOfLife/opentree/issues/553/events","html_url":"https://github.com/OpenTreeOfLife/opentree/issues/553","id":54700060,"number":553,"title":"Incomplete SSL cert chain?","user":{"login":"jimallman","id":446375,"avatar_url":"https://avatars.githubusercontent.com/u/446375?v=3","gravatar_id":"","url":"https://api.github.com/users/jimallman","html_url":"https://github.com/jimallman","followers_url":"https://api.github.com/users/jimallman/followers","following_url":"https://api.github.com/users/jimallman/following{/other_user}","gists_url":"https://api.github.com/users/jimallman/gists{/gist_id}","starred_url":"https://api.github.com/users/jimallman/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jimallman/subscriptions","organizations_url":"https://api.github.com/users/jimallman/orgs","repos_url":"https://api.github.com/users/jimallman/repos","events_url":"https://api.github.com/users/jimallman/events{/privacy}","received_events_url":"https://api.github.com/users/jimallman/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/OpenTreeOfLife/opentree/labels/bug","name":"bug","color":"fc2929"}],"state":"open","locked":false,"assignee":{"login":"jimallman","id":446375,"avatar_url":"https://avatars.githubusercontent.com/u/446375?v=3","gravatar_id":"","url":"https://api.github.com/users/jimallman","html_url":"https://github.com/jimallman","followers_url":"https://api.github.com/users/jimallman/followers","following_url":"https://api.github.com/users/jimallman/following{/other_user}","gists_url":"https://api.github.com/users/jimallman/gists{/gist_id}","starred_url":"https://api.github.com/users/jimallman/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jimallman/subscriptions","organizations_url":"https://api.github.com/users/jimallman/orgs","repos_url":"https://api.github.com/users/jimallman/repos","events_url":"https://api.github.com/users/jimallman/events{/privacy}","received_events_url":"https://api.github.com/users/jimallman/received_events","type":"User","site_admin":false},"milestone":null,"comments":1,"created_at":"2015-01-18T15:41:17Z","updated_at":"2015-01-24T02:05:56Z","closed_at":null,"body":"We've had isolated reports of SSL problems on the production domains, and seen some indications that the SSL cert chain is incomplete. Some possible clues here:\r\n\r\nhttps://www.ssllabs.com/ssltest/analyze.html?d=tree.opentreeoflife.org&hideResults=on&latest\r\nhttps://www.ssllabs.com/ssltest/analyze.html?d=api.opentreeoflife.org&hideResults=on&latest\r\n\r\nAnd a possibly helpful tool to remedy this:\r\nhttps://github.com/zakjan/cert-chain-resolver\r\n\r\nI'll work with @jar398 to see if we've missing something in our deployment scripts."},"comment":{"url":"https://api.github.com/repos/OpenTreeOfLife/opentree/issues/comments/71295579","html_url":"https://github.com/OpenTreeOfLife/opentree/issues/553#issuecomment-71295579","issue_url":"https://api.github.com/repos/OpenTreeOfLife/opentree/issues/553","id":71295579,"user":{"login":"jimallman","id":446375,"avatar_url":"https://avatars.githubusercontent.com/u/446375?v=3","gravatar_id":"","url":"https://api.github.com/users/jimallman","html_url":"https://github.com/jimallman","followers_url":"https://api.github.com/users/jimallman/followers","following_url":"https://api.github.com/users/jimallman/following{/other_user}","gists_url":"https://api.github.com/users/jimallman/gists{/gist_id}","starred_url":"https://api.github.com/users/jimallman/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jimallman/subscriptions","organizations_url":"https://api.github.com/users/jimallman/orgs","repos_url":"https://api.github.com/users/jimallman/repos","events_url":"https://api.github.com/users/jimallman/events{/privacy}","received_events_url":"https://api.github.com/users/jimallman/received_events","type":"User","site_admin":false},"created_at":"2015-01-24T02:05:56Z","updated_at":"2015-01-24T02:05:56Z","body":"OK, I've tested the cert-chain-resolver script above, and it does create a nice .pem that concatenates all certificates in the chain. As a test, I've installed this on **api.opentreeoflife.org** and modified `sites-enabled/001-opentree-ssl` to recognize it by adding a `SSLCertificateChainFile` directive [as described in the Apache docs](http://httpd.apache.org/docs/2.2/mod/mod_ssl.html#sslcertificatechainfile):\r\n```config\r\n    SSLEngine on\r\n    SSLCertificateFile    /etc/ssl/certs/opentree/STAR_opentreeoflife_org.crt\r\n    SSLCertificateChainFile    /etc/ssl/certs/opentree/STAR_opentreeoflife_org.pem\r\n    SSLCertificateKeyFile /etc/ssl/private/opentreeoflife.org.key\r\n```\r\nThis shows up as a complete chain in the SSLLabs test above; compare to the results for **tree.opentreeoflife.org** to see the improvement.\r\n\r\nThe alternative to this combined .pem is probably to use Apache's `SSLCACertificatePath` directive (described here) to point to all the certs in our bundle (STAR_opentreeoflife_org.zip). I'll defer to @jar398 for which path he'd rather take, but I can work on these changes once a decision has been made."}}