Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

For my new startUp I got a SSL certificate from I did all the painful process and finally I was able to implement it on my AWS server (I'm running MEAN Stack). Now when someone visit my website using Firefox the got this error:

Technical Details

Invalid security certificate.

The certificate is not trusted because no issuer chain was provided. (Error code: sec_error_unknown_issuer)

But obviously I don't want my users to receive that warning.

I thought that maybe the server was delivering some file by the regular http and I couldn't find any non-https content, so I imagine I'm ok about that issue (maybe not)

This is my first time using a SSL certificate and maybe I'm doing it wrong. Please if you can help me out will be great. Thanks

Here is the image:

enter image description here

share|improve this question

Although you did install a SSL certificate, you did not include any additional certificates that are necessary to build a trust path. See

About the trust path, the SSL client has some root certificates that are stored. When you buy a certificate C from some CA, they might use some intermediate certficate (let's call this B) that is signed by the root CA A. If you only provide the certificate C to the client, then they will not be able to establish a trust path from A to C. To fix this, append the certificate B to your certificate C.

The exact details depend on the SSL server that you are using, consult their documentation for the specifics.

share|improve this answer
Thanks @Lekenstey, I received these files from PositiveSSL: and mydomain_com.crt. I am using NodeJS/ExpressJS. I took a look at the the documentation but I'm not an expert and is taking me hard times, what should I change? This is my NodeJS code var credentials = {key: privateKey, cert: certificate,}; – lito Jun 14 '14 at 15:58
@lito If I'm not mistaken, you should key + cert or pfx, not both. If you have a single file (for pfx) with keys and certs concatenated, you should append the CA bundle to that file. Otherwise, append the file to the cert. I suggest to keep the keys and certs separate anyway so you can set very tigh permissions on the keys. – Lekensteyn Jun 14 '14 at 16:54
Probably easiest to just supply in the ca field: ` var options = { key: fs.readFileSync(key), cert: fs.readFileSync(cert), ca: fs.readFileSync(chainCert) };` ca can also be an array of certs if you have multiple. – David Rice Oct 20 '14 at 16:47

June 2014:

For NodeJS and ExpressJS

This is the configuration I used and it working fine after banging my head on the wall for some days. I use Express 3.4 (I think is the same for Express 4.0)

var privateKey  = fs.readFileSync('helpers/sslcert/key.pem', 'utf8');
var certificate = fs.readFileSync('helpers/sslcert/csr.pem', 'utf8');

files = ["COMODORSADomainValidationSecureServerCA.crt",

ca = (function() {
  var _i, _len, _results;

  _results = [];
  for (_i = 0, _len = files.length; _i < _len; _i++) {
    file = files[_i];
    _results.push(fs.readFileSync("helpers/sslcert/" + file));
  return _results;

var credentials = {ca:ca, key: privateKey, cert: certificate};

// process.env.PORT : Heroku Config environment
var port = process.env.PORT || 4000;

var app = express();
var server = http.createServer(app).listen(port, function() {
        console.log('Express HTTP server listening on port ' + server.address().port);
https.createServer(credentials, app).listen(3000, function() {
        console.log('Express HTTPS server listening on port ' + server.address().port);

// redirect all http requests to https
app.use(function(req, res, next) {
  if(! {
    return res.redirect(['', req.url].join(''));

Then I redirected the 80 and 443 ports:

sudo iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-ports 4000
sudo iptables -t nat -A PREROUTING -p tcp --dport 443 -j REDIRECT --to-ports 3000

As you can see after checking my certifications I have 4 [0,1,2,3]:

openssl s_client -connect -showcerts | grep "^ "

ubuntu@ip-172-31-5-134:~$ openssl s_client -connect -showcerts | grep "^ "
depth=3 C = SE, O = AddTrust AB, OU = AddTrust External TTP Network, CN = AddTrust External CA Root
verify error:num=19:self signed certificate in certificate chain
verify return:0
 0 s:/OU=Domain Control Validated/OU=PositiveSSL/
   i:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Domain Validation Secure Server CA
 1 s:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Domain Validation Secure Server CA
   i:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Certification Authority
 2 s:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Certification Authority
   i:/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root
 3 s:/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root
   i:/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root
    Protocol  : TLSv1.1
    Cipher    : AES256-SHA
    Session-ID: 8FDEAEE92ED20742.....3E7D80F93226142DD
    Master-Key: C9E4AB966E41A85EEB7....4D73C67088E1503C52A9353C8584E94
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 300 (seconds)
    TLS session ticket:
    0000 - 7c c8 36 80 95 4d 4c 47-d8 e3 ca 2e 70 a5 8f ac   |.6..MLG....p...
    0010 - 90 bd 4a 26 ef f7 d6 bc-4a b3 dd 8f f6 13 53 e9   ..J&..........S.
    0020 - f7 49 c6 48 44 26 8d ab-a8 72 29 c8 15 73 f5 79   .I.HD&.......s.y
    0030 - ca 79 6a ed f6 b1 7f 8a-d2 68 0a 52 03 c5 84 32   .yj........R...2
    0040 - be c5 c8 12 d8 f4 36 fa-28 4f 0e 00 eb d1 04 ce   ........(.......
    0050 - a7 2b d2 73 df a1 8b 83-23 a6 f7 ef 6e 9e c4 4c   .+.s...........L
    0060 - 50 22 60 e8 93 cc d8 ee-42 22 56 a7 10 7b db 1e   P"`.....B.V..{..
    0070 - 0a ad 4a 91 a4 68 7a b0-9e 34 01 ec b8 7b b2 2f   ..J......4...{./
    0080 - e8 33 f5 a9 48 11 36 f8-69 a6 7a a6 22 52 b1 da   .3..H...i....R..
    0090 - 51 18 ed c4 d9 3d c4 cc-5b d7 ff 92 4e 91 02 9e   .....=......N...
    Start Time: 140...549
    Timeout   : 300 (sec)
    Verify return code: 19 (self signed certificate in certificate chain)

Good luck! PD: if u want more answers please check:

share|improve this answer
You should not include the root CA. It is no use (it does not help in building a trust path) and enlarges the initial handshake size. Please test your setup with the ssllabs tool I linked above. – Lekensteyn Jun 21 '14 at 12:54

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.