User's Manual Part 2

December 20, 2004 SCP-LPS20x-011-012-01H
ADC Telecommunications, Inc. 155
STEP 2: PREPARING THE CERTIFICATE CHAIN
When a web browser connects to the LPS-20x using SSL, the LPS-20x only sends its own SSL certificate to the
browser. This means that if the certificate has been signed by an intermediate certificate authority, and if the web
browser only knows about the root certificate authority that signed the Public Key Certificate of the Intermediate
certificate authority, the web browser will not get the whole certificate chain it needs to validate the identity of the
LPS-20x.
To resolve this problem, all the public key certificates must be appended to the certificate (www.company.com.pem
file, for example) in base64 format.
For example, if the LPS-20x certificate has been signed by an intermediate CA (CA2), and if the public key
certificate for CA2 was signed by CA1 root CA, the following certificates should be appended to the file
www.company.com.pem.
-----BEGIN CERTIFICATE-----
this is CA1 certificate
in BASE64/PEM encoding
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
this is CA2 certificate
in BASE64/PEM encoding
-----END CERTIFICATE-----
When done, the www.company.com.pem file should look like this:
-----BEGIN CERTIFICATE-----
insert the www.company.com certificate in BASE64/PEM encoding
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
insert the CA1 certificate in BASE64/PEM encoding
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
insert the CA2 certificate in BASE64/PEM encoding
-----END CERTIFICATE-----
This does not apply when using self-signed certificates, since these certificates implicitly contain the whole
chain.