Node.js Using SSL Wildcard Breaks on Mobile

I've got a Node.js server that runs on sub.domain.com, using SSL. It's been working perfectly for months on desktop browsers, but I just noticed that it doesn't work on mobile browsers.

I've done a bit of research and there's a lot of people suggesting that there is something wrong with my certificate chain. I've changed my code to look like there's but still no luck.

Here's my code:

var httpsOptions = {
    ca: [fs.readFileSync("certrequest.csr")],
    key: fs.readFileSync("privatekey.pem"),
    cert: fs.readFileSync("certificate.pem")
};

var app = http.createServer(httpsOptions, function(req, res) {
    log.cnsl.write("HTTP Request received from " + req.connection.remoteAddress);
        //Do stuff
});

I'm running this command to view some debug information (my server runs on port 5673):

openssl s_client -connect sub.domain.com:5673 -showcerts | grep "^ "

Below is the important part of that output

depth=0 O = *.domain.com, OU = Domain Control Validated, CN = *.domain.com
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 O = *.domain.com, OU = Domain Control Validated, CN = *.domain.com
verify error:num=27:certificate not trusted
verify return:1
depth=0 O = *.domain.com, OU = Domain Control Validated, CN = *domain.com
verify error:num=21:unable to verify the first certificate
verify return:1

It sounds rather weird that you've put your certificate request file "certrequest.csr" as the CA.

The CA field should contain the certificate chain from your personal certificate to th root certificate. In my configuration, it contains 2 entries. One as the root certificate itself and the second one as the intermediate one because my issuer offers multiple levels of certifications.

By the way, your certification company most certainly provides you with such informations in their FAQ for example.

As an example, here is an extract of my configuration :

var httpsOptions = {
    key:fs.readFileSync('/etc/ssl/private/ssl-main.key'),
    cert:fs.readFileSync('/etc/ssl/private/ssl-main.crt'),
    ca:[fs.readFileSync('/etc/ssl/private/ca.pem'),
        fs.readFileSync('/etc/ssl/private/sub.class2.server.ca.pem')]
};

Anyway, this does not explain why It works for non mobile browsers. My only guess is that they my embed themselves a part of the chain while the mobiles wont't for disk space reasons.

Hope this helps.