Node.js Express部署的VPS网站：移动端除Chrome外其他浏览器不信任Let's Encrypt SSL证书求助

First, let's zero in on the likely culprit here: your manual parsing of the fullchain.pem file is probably introducing subtle inconsistencies in the certificate chain that mobile browsers (especially Safari and Firefox) are stricter about validating—even though SSL Labs reports the chain as trusted.

The Problem in Your Configuration #

You’re splitting fullchain.pem into a ca array, but fullchain.pem already includes your domain certificate (cert.pem) plus all required intermediate certificates. By passing both cert: certificate (from cert.pem) and ca: caa (parsed from fullchain), you’re essentially including your domain certificate twice in the chain. Mobile browsers tend to reject this redundant chain structure, even if desktop browsers are more forgiving.

Fixed Configuration #

Let’s simplify your SSL setup to use Let’s Encrypt’s standard files correctly—no manual parsing required:

const port = 443;
const fs = require('fs');
const express = require("express");
const https = require('https');
const app = express();

// Load Let's Encrypt files directly (no manual parsing needed)
const privateKey = fs.readFileSync('C:/Certbot/live/uniroad.co.za/privkey.pem');
// Use fullchain.pem directly as the cert: it includes your domain cert + all intermediates
const fullChainCertificate = fs.readFileSync('C:/Certbot/live/uniroad.co.za/fullchain.pem');

const options = {
  key: privateKey,
  cert: fullChainCertificate, // No separate ca needed when using fullchain
  dotfiles: "ignore",
  etag: true,
  extensions: ["htm", "html"],
  index: false,
  maxAge: 5000,
  redirect: false,
  setHeaders: function(res, _path, _stat) {
    res.set("x-timestamp", Date.now());
  }
};

const httpsServer = https.createServer(options, app);
const io = require('socket.io')(httpsServer);

app.use(express.static("C:/Users/Administrator/Documents/Website/"));
app.use((req, res) => {
  res.sendFile('C:/Users/Administrator/Documents/Website/index.html');
});

httpsServer.listen(port, () => {
  console.log(`Listening on port ${port}`);
});

Why This Works #

• fullchain.pem is purpose-built to be used directly as the cert value in Node.js/Express. It contains your domain’s end-entity certificate followed by all necessary intermediate certificates, forming a complete, valid chain that all browsers (mobile included) can parse without issues.
• Removing the manual parsing eliminates the risk of formatting errors (like extra newlines or incorrect certificate splitting) that might break chain validation on stricter mobile browsers.

Quick Additional Checks #

1. Verify Certificate File Integrity: If you’re still seeing issues, re-download your certificates using Certbot to ensure fullchain.pem hasn’t been corrupted.
2. Clear Mobile Browser Caches: Mobile browsers often cache invalid certificate data—force-close the browser and clear its cache before testing again.
3. Check Device Time: Incorrect system time on mobile devices can trigger SSL validation failures, even with a valid certificate. Double-check the device’s date and time settings.

内容的提问来源于stack exchange，提问作者Nelson Wilson