Hacker News Reader

Comment by duncanawoods | Hacker News Reader

I recently tried the free startssl cert.

Fine on IOS/OSX/W7 Chrome/Safari/Firefox/IE but it was rejected by Android default browser where startssl must not be a known CA.

I don't think I can do without Android.

View on HN

Either you misconfigured it or you tested using Android <2.1[1] which accounts for less than 1% Android users.

https://code.google.com/p/android/issues/detail?id=21632

Thanks for the link, it helped me get there. I followed the documentation and tutorials for nodejs/express which defined the cert and key. As your link suggested, mobile browsers are less lenient about missing intermediate ca information so adding this solved it:

    var express = require('express'),
        path = require('path'),
        http = require('http'),
        https = require('https'),
        fs = require ('fs');
    
    var app = express();
    
    var options = {
      key: fs.readFileSync('cert/rsa.key'),
      cert: fs.readFileSync('cert/rsa.crt'),
      ca: fs.readFileSync('cert/sub.class1.server.ca.pem') // needed this
    };

    https.createServer(options, app).listen(443);

I have no issues with their certs on android 2.3.

Reply on news.ycombinator.com