I am trying to access a VPN server with an address like https://vpn.example.com using Firefox on Vista with the Sun Java plugin (SE 6 U24).

I'm using a server certificate issued by RapidSSL - signed by RapidSSL which is signed by GeoTrust Global CA. The Geotrust root is in the browser store and also in the system Java keystore.

No problem accessing the server with the browser. But when the VPN Java applet starts up and tries to access the server, I get a security challenge - unknown publisher, cert issued by a source that is not trusted.

Using the same VPN software on the internal server https://vpn-int.example.com , with a server certificate signed directly by our CA, there is no problem once I install our CA root in the client keystore.

Is this because the RapidSSL cert is chained and Java does not understand that, or something simpler (finger trouble) ?

If I extract the intermeticate RapidSSL certificate to a file using Firefox, then add it to the keystore, the warnings go away. Not really that helpful, I could just have trusted the appliance certificate (unless I had hndreds of them)


You should add RapidSSL_CA_bundle.pem (the intermediate cert) to the Java keystore. Refer below enlisted url to solve an error of RapidSSL root installation.


  • That's basically what I did, extracting the intermediate certificate on the client. Is this an ongoing problem with Java, that it can't handle chained certificates, or something peculiar to RapidSSL ? – Andrew May 11 '12 at 1:07
  • It turns out that I can install the intermediate certificate bundle on the VPN appliance, which should fix the problem for all clients. – Andrew May 12 '12 at 0:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.