Mac Safari OS 不接受服务器证书

Question 1

有几件事：

通配符适用于域名的给定级别。如果您的通配符是“*.example.com”，则裸名称“example.com”不包含在内。您需要一个主题备用名称来覆盖额外的“example.com”。

第二个问题：

当我访问任一 URL 时，都会收到验证失败的消息。例如：

$ curl -Iv https://www.profcoach.nl/
* About to connect() to www.profcoach.nl port 443 (#0)
*   Trying 91.224.164.224... connected
* Connected to www.profcoach.nl (91.224.164.224) port 443 (#0)
* SSLv3, TLS handshake, Client hello (1):
* SSLv3, TLS handshake, Server hello (2):
* SSLv3, TLS handshake, CERT (11):
* SSLv3, TLS alert, Server hello (2):
* SSL certificate problem, verify that the CA cert is OK. Details:
error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed

当我查看证书本身时，我看到：

$ openssl s_client -connect www.profcoach.nl:443 | openssl x509 -noout -subject
depth=1 /C=BE/O=GlobalSign nv-sa/CN=GlobalSign Domain Validation CA - G2
verify error:num=20:unable to get local issuer certificate
verify return:0
subject= /OU=Domain Control Validated/CN=*.profcoach.nl

因此通用名称应该适用于 www.profcoach.nl。

您是否按照证书颁发机构的说明安装任何中级证书？

https://www.globalsign.com/support/intermediate-root-install.php

他们似乎在侧边栏上有 IIS 的安装说明。

哦，我刚刚意识到 Globalsign 去年是伊朗黑客的目标（http://www.theregister.co.uk/2011/09/07/globalsign_suspends_ssl_cert_biz/）。他们可能已经删除了较旧的中间证书，因此您需要确保已安装其当前证书，因此 Mac 上的混乱可能与此有关。我会就此问题联系他们的支持人员以获得澄清。

更新

使用捆绑包https://www.globalsign.com/support/intermediate/domain_bundle2011.php。我把这个包放入一个文件中foo.crt，然后运行curl -Iv --cacert foo.crt https://www.profcoach.nl验证正确：

$ curl -Iv --cacert foo.crt https://www.profcoach.nl
* About to connect() to www.profcoach.nl port 443 (#0)
*   Trying 91.224.164.224... connected
* Connected to www.profcoach.nl (91.224.164.224) port 443 (#0)
* successfully set certificate verify locations:
*   CAfile: foo.crt
  CApath: none
* SSLv3, TLS handshake, Client hello (1):
* SSLv3, TLS handshake, Server hello (2):
* SSLv3, TLS handshake, CERT (11):
* SSLv3, TLS handshake, Server finished (14):
* SSLv3, TLS handshake, Client key exchange (16):
* SSLv3, TLS change cipher, Client hello (1):
* SSLv3, TLS handshake, Finished (20):
* SSLv3, TLS change cipher, Client hello (1):
* SSLv3, TLS handshake, Finished (20):
* SSL connection using AES128-SHA
* Server certificate:
*    subject: OU=Domain Control Validated; CN=*.profcoach.nl
*    start date: 2012-07-05 14:59:04 GMT
*    expire date: 2013-07-06 14:59:04 GMT
*    subjectAltName: www.profcoach.nl matched
*    issuer: C=BE; O=GlobalSign nv-sa; CN=GlobalSign Domain Validation CA - G2
*    SSL certificate verify ok.

Answer