Make Nginx send the intermediate certificate along with the server's.

1 files changed, 4 insertions, 1 deletions

diff --git a/roles/webmail/files/etc/nginx/sites-available/roundcube b/roles/webmail/files/etc/nginx/sites-available/roundcube
index 0c54bf2..5bff410 100644
--- a/roles/webmail/files/etc/nginx/sites-available/roundcube
+++ b/roles/webmail/files/etc/nginx/sites-available/roundcube
@@ -20,7 +20,10 @@ server {
     root         /var/lib/roundcube;
 
     include ssl/config;
-    ssl_certificate     /etc/nginx/ssl/mail.fripost.org.pem;
+    # include the intermediate certificate, see
+    # - https://www.ssllabs.com/ssltest/analyze.html?d=mail.fripost.org
+    # - http://nginx.org/en/docs/http/configuring_https_servers.html
+    ssl_certificate     /etc/nginx/ssl/mail.fripost.org.chained.pem;
     ssl_certificate_key /etc/nginx/ssl/mail.fripost.org.key;
 
     location = /favicon.ico {