= bug description =

kojipkgs.fedoraproject.org sends the server certificate twice: once at the start of the chain, then again as the first intermediate. Then it sends a DigiCert intermediate as the third and final cert.

= bug analysis =

{{{
$ gnutls-cli kojipkgs.fedoraproject.org
Processed 182 CA certificate(s).
Resolving 'kojipkgs.fedoraproject.org'...
Connecting to '209.132.181.10:443'...
- Certificate type: X.509
- Got a certificate list of 3 certificates.
- Certificate[0] info:
- subject C=US,ST=North Carolina,L=Raleigh,O=Red Hat Inc.,CN=*.fedoraproject.org', issuerC=US,O=DigiCert Inc,OU=www.digicert.com,CN=DigiCert SHA2 High Assurance Server CA', RSA key 4096 bits, signed using RSA-SHA256, activated 2014-04-22 00:00:00 UTC', expires2017-04-26 12:00:00 UTC', SHA-1 fingerprint `397a9c0813c2fb2e708063109586ff8805cfb86e'
Public Key ID:
5fdf01b948c3491e6ad97783db51802d1dae2d7d
Public key's random art:
+--[ RSA 4096]----+
| o +oo.|
| B =.= .|
| + B .+ |
| . . ++ o|
| S .+oooE|
| . . o o.|
| . . .|
| |
| |
+-----------------+

• Certificate[1] info:
• subject C=US,ST=North Carolina,L=Raleigh,O=Red Hat Inc.,CN=*.fedoraproject.org', issuerC=US,O=DigiCert Inc,OU=www.digicert.com,CN=DigiCert SHA2 High Assurance Server CA', RSA key 4096 bits, signed using RSA-SHA256, activated 2014-04-22 00:00:00 UTC', expires2017-04-26 12:00:00 UTC', SHA-1 fingerprint `397a9c0813c2fb2e708063109586ff8805cfb86e'
• Certificate[2] info:
• subject C=US,O=DigiCert Inc,OU=www.digicert.com,CN=DigiCert SHA2 High Assurance Server CA', issuerC=US,O=DigiCert Inc,OU=www.digicert.com,CN=DigiCert High Assurance EV Root CA', RSA key 2048 bits, signed using RSA-SHA256, activated 2013-10-22 12:00:00 UTC', expires2028-10-22 12:00:00 UTC', SHA-1 fingerprint `a031c46782e6e6c662c2c87c76da9aa62ccabd8e'
• Status: The certificate is trusted.
• Description: (TLS1.2)-(RSA)-(AES-128-CBC)-(SHA1)
• Session ID: 64:40:85:E6:CC:C4:AF:35:86:FE:11:1E:99:43:1D:77:55:5B:EB:04:45:4F:E3:72:FF:39:64:AA:16:05:39:33
• Version: TLS1.2
• Key Exchange: RSA
• Cipher: AES-128-CBC
• MAC: SHA1
• Compression: NULL
• Options: safe renegotiation,
• Handshake was completed
  }}}

So Certificate[0] == Certificate[1]. Most tools (including gnutls-cli) will ignore the duplicate cert, but it's arguably invalid. glib-networking prior to 2.42 will reject a chain unless each certificate is followed by its issuer. This is probably why you can't connect to this site e.g. using libsoup on RHEL 7.1. I think F20 will be broken too. Easiest way to test would be to just try loading the page in Epiphany.

= fix recommendation =

Send the Fedora cert only once. With Apache, I think you'll have one file for the server cert and one for all the intermediates: the DigiCert cert is your only intermediate so it should be alone in that file.