StartCom cert not working in Firefox 4 beta

The reporter observed that visiting https://jwatt.org/ in Firefox 4 beta rejected the certificate, while it worked in Firefox 3.6. Firefox 4 beta reported that the certificate was not trusted because no issuer chain was provided (sec_error_unknown_issuer). StartCom (Eddy Nigg) responded that the server was not sending the complete CA certificate chain as required and provided StartSSL links with instructions to correct the configuration. The reporter later updated the site to include the intermediate certificate, after which it worked in both Firefox 4 beta 6 and beta 7. The StartCom representative indicated that if adding the missing chain fixed the issue, then the behavior was correct. The bug was ultimately marked RESOLVED with resolution INVALID.

1. 2010-11-11 Reporter reported that jwatt.org’s certificate was rejected in Firefox 4 beta due to a missing issuer chain.
2. 2010-11-11 StartCom advised that the server must send the complete CA certificate chain and linked instructions to fix it.
3. 2010-11-11 Reporter updated the site to include the intermediate certificate, after which it worked in Firefox 4 beta 6 and beta 7.

1. 2010-11-11 Jwatt representative — Reported that jwatt.org worked in Firefox 3.6 but was rejected in Firefox 4 beta with sec_error_unknown_issuer due to no issuer chain being provided.
2. 2010-11-11 Startcom representative — Said the server was not sending the complete CA certificate chain as required and pointed to StartSSL instructions to correct it.
3. 2010-11-11 Jwatt representative — Questioned whether Firefox 4 beta 7 should also reject it given the earlier comment, and noted that other browsers appeared to accept it.
4. 2010-11-11 Startcom representative — Explained that the browser may have a cached copy, but the installation is incomplete and visitors would see the error until the server configuration is fixed.
5. 2010-11-11 Jwatt representative — Updated the site to include the intermediate certificate and stated it then worked in beta 6 as well as beta 7.
6. 2010-11-11 Startcom representative — Confirmed that if the update fixed it, the behavior should be considered correct.