Technical Documentation¶

Download the intermediary certificates¶

You will want to download and install the intermediate certificate on your servers to ensure that your visitors can validate the trust chain all the way back to the root certificate.

Installation of the intermediate cert is MANDATORY for ALL TYPES of SSL certificates, as Gandi is not a CA, Comodo is. We need to install the intermediate certificate to complete the certification chain between the issuer (Gandi) and the root CA (Comodo).

Standard SSL Certificate¶

If you have a Standard SSL certificate and you want to get your intermediate Gandi certificate, you can get them by right-clicking on the applicable link and selecting „Save link as…“:

DER format: http://crt.gandi.net/GandiStandardSSLCA2.crt
PEM format: https://www.gandi.net/static/CAs/GandiStandardSSLCA2.pem

Pro SSL Certificate¶

If you have a Pro SSL certificate and you want to get your intermediate certificate, right-click on the applicable link and select „Save link as…“:

DER format: http://crt.gandi.net/GandiProSSLCA2.crt
PEM format: https://www.gandi.net/static/CAs/GandiProSSLCA2.pem

Comodo Cross-Signed Certificate¶

Not all web browsers have implemented the Root CA for SHA2 certificates. Consequently, it may be necessary to add the cross-signed certificate below to your server so that the client can verify the certification chain.

The installation of the certificate depends on the program used. Recent versions of Chrome already support SHA2 certificates, Mozilla is in the process of adding it in the latest versions of Firefox as well as certain distributions. We recommend that you add the cross-signed certificate to your server in order to reduce the risk of incompatibility with your customers.

You may download the certificate in DER format at the following address: http://crt.usertrust.com/USERTrustRSAAddTrustCA.crt or recover it from the PEM format below:

In order to use it, you will have to create a bundle with the Gandi SHA2 intermediate certificate.

In your bundle file :

-----BEGIN CERTIFICATE-----
XXXXXXXXX   <- intermediate certificate
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
XXXXXXXXX   <- cross-signed certificate
-----END CERTIFICATE-----

Once done, with Apache2 for instance, you will just have use the SSLCertificateChainFile directive and define localisation of your bundle file.

SSLCAcertificatefile won’t be needed anymore in this case.

Revoked certificates¶

The list of revoked certificates is available via OCSP protocol. Our server is located at the following address: http://ocsp.gandi.net