Search code examples
sslhttpscertificate

What's the `x_budle-g2-g1.crt` in Apache certificate directory?

I applied the Apache certificates from Goddady, in the directory there have:

enter image description here

I checked them, the x.crt content is as the same as x.pem(only one CERTIFICATE), the x_bundle-g2-g1.crt has 3 CERTIFICATE in it.

Why there need the same content x.crt and x.pem?
What's the function of x_bundle-g2-g1.crt, where there have 3 CERTIFICATE, whether them refer to x_bundle, g2 and g1?

Solution

  • I'd guess that X.pem is your server certificate, and it is issued by GoDaddy Secure Certificate Authority - G2

    Then x_bundle-g2-g1.crt is the chain of trust till the root GoDaddy certificate.

    Check the contents of x_bundle-g2-g1.crt using openssl command:

    openssl crl2pkcs7 -nocrl -certfile x_bundle-g2-g1.crt | openssl pkcs7 -print_certs -text -noout | grep -E 'Subject:|Issuer:'

    This hack is to print all certificates in PEM file

    I expect the output would be like this:

            Issuer: C=US, ST=Arizona, L=Scottsdale, O=GoDaddy.com, Inc., CN=Go Daddy Root Certificate Authority - G2
        Subject: C=US, ST=Arizona, L=Scottsdale, O=GoDaddy.com, Inc., OU=http://certs.godaddy.com/repository/, CN=Go Daddy Secure Certificate Authority - G2
        Issuer: C=US, O=The Go Daddy Group, Inc., OU=Go Daddy Class 2 Certification Authority
        Subject: C=US, ST=Arizona, L=Scottsdale, O=GoDaddy.com, Inc., CN=Go Daddy Root Certificate Authority - G2
        Issuer: C=US, O=The Go Daddy Group, Inc., OU=Go Daddy Class 2 Certification Authority
        Subject: C=US, O=The Go Daddy Group, Inc., OU=Go Daddy Class 2 Certification Authority

    That is,

    1. Go Daddy Secure Certificate Authority - G2 signed by Go Daddy Root Certificate Authority - G2
    2. Go Daddy Root Certificate Authority - G2
    3. self-signed Go Daddy Class 2 Certification Authority

    Check which certificates your web server provides to the client: openssl s_client -showcerts -servername YOUR_SERVER -connect YOUR_SERVER:443 </dev/null

    I'd bet that it provides the complete chain -

    • your server certificate from X.pem
    • Go Daddy Secure Certificate Authority - G2
    • Go Daddy Root Certificate Authority - G2

    This is a precaution for end systems, such as brosers, that miss intermediate GoDaddy certificate.