title: How to force Apache 2.2 to send the full certificate chain?
body: <p>We are using Apache 2.2.25 with <em>mod_ssl</em> in the reverse proxy mode using <em>mod_proxy</em>. It has a server certificate we use for testing purposes, issued by GoDaddy. There are 3 certificates in the chain, <code>server cert -&gt; GoDaddy intermediate CA -&gt; GoDaddy Root CA</code>. The intermediate CA (<em>Go Daddy Secure Certificate Authority - G2</em>) is not always found in clients' list of trusted CA.</p>
  
  <p>The SSL connection to the server works well for browsers (at least for some), but not for some other clients. We noticed that our server does not send the full certificate chain, by using the following command: <code>openssl s_client -showcerts -connect SERVER_URL:443</code>, and indeed the command reports the error <code>Verify return code: 21 (unable to verify the first certificate)</code></p>
  
  <p>We use the <code>SSLCertificateFile</code> directive in each VirtualHost:</p>
  
  <pre><code>SSLCertificateFile certificate.crt
  </code></pre>
  
  <p>Where the certificate.crt file contains the private key and all the certificates in the chain.
  We tried to split it into the following:</p>
  
  <pre><code>SSLCertificateFile server.crt
  SSLCertificateKeyFile server.key
  SSLCertificateChainFile chain.crt
  </code></pre>
  
  <p>But this didn't change anything.</p>
  
  <p>Thanks for your help!</p>
  
  <p><strong>EDIT</strong><br>
  The plot thickens - it seems to be some combination of the certificate and the server.<br>
  (testing is done with the <a href="https://www.sslshopper.com/ssl-checker.html" rel="noreferrer">SSL Shopper</a> tool)</p>
  
  <ol>
  <li>Go Daddy certificate (as above) on Apache 2.2 (RHEL) - <strong>does not work</strong></li>
  <li>same certificate, on IIS7 - <strong>works</strong></li>
  <li>customer's certificate (from Comodo) on Apache 2.2 RHEL - <strong>works</strong></li>
  </ol>