Hi @RKrishna001836 (Community Member)​ ,

Veracode Dynamic Analysis reports flaws of CWE 296 when it sees that the certificate chain has not been correctly setup.

The concern is that, while many SSL/TLS clients will correct for this error, not all will and some clients will not be able to verify the correctness of the chain and be susceptible to a MITM attack.

The certificate chain should look something like this:

1. Subject: your domain, Issuer: intermediate certificate
2. Subject: intermediate certificate, Issuer: root certificate

Note that it is not recommended to include the root certificate.

Reviewing the provided screenshot from Digicert we can see that their tool also indictes (with red broken chain links) that the chain is broken.

Here is another way to get this information from a Linux client:

% openssl s_client -connect www.ucare.org:443

CONNECTED(00000005)

depth=2 C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Global Root G2

verify return:1

depth=1 C = US, O = DigiCert Inc, CN = DigiCert Global G2 TLS RSA SHA256 2020 CA1

verify return:1

depth=0 C = US, ST = Minnesota, L = Minneapolis, O = UCare Minnesota, CN = ucare.org

verify return:1

---

Certificate chain

 0 s:C = US, ST = Minnesota, L = Minneapolis, O = UCare Minnesota, CN = ucare.org

  i:C = US, O = DigiCert Inc, CN = DigiCert Global G2 TLS RSA SHA256 2020 CA1

  a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256

  v:NotBefore: Oct 9 00:00:00 2023 GMT; NotAfter: Nov 8 23:59:59 2024 GMT

 1 s:C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Global Root G2

  i:C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Global Root G2

  a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256

  v:NotBefore: Aug 1 12:00:00 2013 GMT; NotAfter: Jan 15 12:00:00 2038 GMT

 2 s:C = US, O = DigiCert Inc, CN = DigiCert Global G2 TLS RSA SHA256 2020 CA1

  i:C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Global Root G2

  a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256

  v:NotBefore: Mar 30 00:00:00 2021 GMT; NotAfter: Mar 29 23:59:59 2031 GMT

Here we can see the chain that's configured for this website is instead:

1. Subject: ucare.org, Issuer: DigiCert Global G2 TLS RSA SHA256 2020 CA1 (Good!)
2. Subject: DigiCert Global Root G2, Issuer: DigiCert Global Root G2 (Self signed root certificate, should NOT be present)
3. Subject: DigiCert Global G2 TLS RSA SHA256 2020 CA1, Issuer: DigiCert Global Root G2 (Should come after 1)

You can learn more on how to set up certificate chains in IIS 10 from the Digicert website: https://knowledge.digicert.com/quovadis/ssl-certificates/ssl-installation/how-do-i-install-an-ssl-certificate-into-microsoft-iis-10.html .

Thank you,

Boy Baukema