Cloudflare Developers•5d ago

Full SSL/TLS in need of intermediate PEM key?

Hey, pretty new to this and now im stuck! So, i've set up my webserver using nginx and i've set my cloudflare SSL to Full. so in NGINX i assigned my ssl keys to origin server .key and .pem from cloudflare. and i ended up getting stapling errors, and also seem to be unable to get my landing page to show.

[warn] 690#690: "ssl_stapling" ignored, issuer certificate not found for certificate

[warn] 690#690: "ssl_stapling" ignored, issuer certificate not found for certificate

So my friend the LLM kept mentioning that my "Second" key in my PEM, is incorrect it was showing a "Google" Issuer, i.e. the Cloudflare Edge Certificate key in some way related to the proxied dns? however i seem to be unable to retrieve the correct "Intermediary" key. The expected chain:

depth=0 O = "CloudFlare, Inc.", OU = CloudFlare Origin CA, CN = CloudFlare Origin Certificate
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 O = "CloudFlare, Inc.", OU = CloudFlare Origin CA, CN = CloudFlare Origin Certificate
verify error:num=21:unable to verify the first certificate
verify return:1
depth=0 O = "CloudFlare, Inc.", OU = CloudFlare Origin CA, CN = CloudFlare Origin Certificate
verify return:1

depth=0 O = "CloudFlare, Inc.", OU = CloudFlare Origin CA, CN = CloudFlare Origin Certificate
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 O = "CloudFlare, Inc.", OU = CloudFlare Origin CA, CN = CloudFlare Origin Certificate
verify error:num=21:unable to verify the first certificate
verify return:1
depth=0 O = "CloudFlare, Inc.", OU = CloudFlare Origin CA, CN = CloudFlare Origin Certificate
verify return:1

however my second key:

 1 s:C = US, O = Google Trust Services, CN = WE1
   i:C = US, O = Google Trust Services LLC, CN = GTS Root R4

 1 s:C = US, O = Google Trust Services, CN = WE1
   i:C = US, O = Google Trust Services LLC, CN = GTS Root R4

i have 2 keys in total in my .pem file, 1 of them being the incorrect Google Trust Services Apologies in advance if my explanation doesn't make any sense:|

6 Replies

Cyb3r-Jak3•5d ago

As you are using an origin certificate, you are unable to do SSL stapling.

GuozOP•5d ago

😮 What type of certificate would i need instead? Thanks for your reply btw.

Cyb3r-Jak3•5d ago

You need a publicly trusted certificate. Using something like letsencrypt would get you one Also SSL stapling would just be between your server and Cloudflare. Cloudflare shows the universal certificate to the end user

GuozOP•5d ago

I see thanks alot sir

GuozOP•5d ago

https://tenor.com/view/top-gun-top-gun-maverick-salute-tom-cruise-military-gif-26899454

Tenor

GuozOP•5d ago

i'll be on it

Gaming

Programming

Full SSL/TLS in need of intermediate PEM key?

Did you find this page helpful?