web-services - 此服务的 SSL 证书不可信任

Question

我们使用 Serverscan 扫描了我们的网站 acbd.com，报告显示“此服务的 SSL 证书不可信任”。

我们使用的是 Comodo Premium SSL 通配符证书，它在我们的网站上运行良好，我们为 HTTPS 和 RDC 设置了相同的证书。但是当我们扫描我们的网站以获取 PCI 合规性时，它失败了。以下是 PCI 合规性扫描失败的完整详细信息:

Application: https
Port: 443
Protocol: tcp
VATID: 51192
Synopsis :
The SSL certificate for this service cannot be trusted.
Description :
The server's X.509 certificate does not have a signature from a known public certificate authority. This situation can occur in three different ways, each of which results in a break in the chain below which certificates cannot be trusted.
First, the top of the certificate chain sent by the server might not be descended from a known public certificate authority. This can occur either when the top of the chain is an unrecognized, self-signed certificate, or when intermediate certificates are missing that would connect the top of the certificate chain to a known public certificate authority.
Second, the certificate chain may contain a certificate that is not valid at the time of the scan. This can occur either when the scan occurs before one of the certificate's 'notBefore' dates, or after one of the certificate's 'notAfter' dates.
Third, the certificate chain may contain a signature that either didn't match the certificate's information, or could not be verified. Bad signatures can be fixed by getting the certificate with the bad signature to be re-signed by its issuer. Signatures that could not be verified are the result of the certificate's issuer using a signing algorithm that Nessus either does not support or does not recognize.
If the remote host is a public host in production, any break in the chain makes it more difficult for users to verify the authenticity and identity of the web server. This could make it easier to carry out man-in-the-middle attacks against the remote host.

Solution :

Purchase or generate a proper certificate for this service.
CVSS Base Score : 6.4
(CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N)
Plugin output :
The following certificates were part of the certificate chain sent by the remote host, but have signatures that use algorithms that Nessus does not recognize :

这个我看不懂。你能详细说明一下吗？据我了解，Comodo Premium SSL 通配符证书不受信任。

请告诉我它在 PCI 合规性测试中失败的原因。为什么显示“无法信任此服务的 SSL 证书”？

如何通过 PCI Compliance Test？

Answer 1

如果扫描服务失败但浏览器接受了证书，则可能是这样的:“...或者当中间证书丢失时...”。根据 https://www.ssllabs.com/ssltest/ 检查您的服务器您可能会获得更多信息。