We scanned our website acbd.com with Serverscan PCI Compliance and reports show that “The SSL certificate for this service cannot be trusted”.
Website is hosted on dedicated server windows 2008 R2 and We are using aComodo Premium SSL Wildcard Certificate and it's working fine for our website and we setup the same for HTTPS and RDC. But when we scan our website for PCI Compliance it fails. Here are complete details of the PCI Compliance Scan fail:
Application: https
Port: 443
Protocol: tcp
VATID: 51192
Synopsis :
The SSL certificate for this service cannot be trusted.
Description :
The server's X.509 certificate does not have a signature from a known public certificate authority. This situation can occur in three different ways, each of which results in a break in the chain below which certificates cannot be trusted.
First, the top of the certificate chain sent by the server might not be descended from a known public certificate authority. This can occur either when the top of the chain is an unrecognized, self-signed certificate, or when intermediate certificates are missing that would connect the top of the certificate chain to a known public certificate authority.
Second, the certificate chain may contain a certificate that is not valid at the time of the scan. This can occur either when the scan occurs before one of the certificate's 'notBefore' dates, or after one of the certificate's 'notAfter' dates.
Third, the certificate chain may contain a signature that either didn't match the certificate's information, or could not be verified. Bad signatures can be fixed by getting the certificate with the bad signature to be re-signed by its issuer. Signatures that could not be verified are the result of the certificate's issuer using a signing algorithm that Nessus either does not support or does not recognize.
If the remote host is a public host in production, any break in the chain makes it more difficult for users to verify the authenticity and identity of the web server. This could make it easier to carry out man-in-the-middle attacks against the remote host.Solution :
Purchase or generate a proper certificate for this service.
CVSS Base Score : 6.4
(CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N)
Plugin output :
The following certificates were part of the certificate chain sent by the remote host, but have signatures that use algorithms that Nessus does not recognize
I can't understand this. Can you please elaborate this? As per of my understanding that Comodo Premium SSL Wildcard Certificate is not trusted.
Please let me know why it fails in the PCI Compliance Test. Why does it show that “The SSL certificate for this service cannot be trusted”?
How can pass PCI Compliance Test?