Cameleon SSL Server Certificate Chain Root - TDC Internet Root CA, good on it's own or a subcertificate from Entrust

Ouch, shall i dismiss my childhood PKI-knowledge? I've stumbled upon a certificate issue that I just can't figure out. As far as I known when a new certificate is created it's locked onto that (trust) chain, but here it's seems like the root certificate has been swap'ed with a another one which is second in chain. I've realized that I'll not be able to figure this out until I by occasion find a clue, so here's the facts.

The SSL Server Certificates issued by TDC some times use the Entrust root certificate. It looks like especially IE6/7 doesn't care much for it, that is until you removed the old root certificate from your trust store! As an example I'll take the website http://www.digitalsignatur.dk run and owned by ITST.

Seen with Firefox 3

If you access the website with SSL/TLS and look and view the SSL Server Certificate Information:

This is all pretty straight (serial numer 3E:2C:75:88, and the TDC Internet Root CA:

with the serialnumber 42:86:EC:F3:

and the root certificate is from Entrust:

Seen with Internet Explorer 7

But if you were to do the same with IE7 the certificate path looks like:

where the root certificate is the TDC Internet Root CA (serialnumber 3a cc a5 4c):

and in between is the TDC SSL Server CA with the serialnumber 3c 1a 02 e2.

which is strange since it's different and has another serialnumber 3a cc a5 4c (from a different CA so theses serialnumber are not related:

Whats even more strange is that when i remove this root certificate from the trust store I'll end up with:

Seen with nice little webtool from DigiCert

DigiCert has a nice little tool that display certificate chains from web servers called SSL Certificate Check, and it displays the (full) Entrust chain variant:

Seen with OpenSSL

This seems very confusing, so eliminate the browser userinterface differenties I'll try and call with OpenSSL_

openssl s_client -showcerts -connect www.digitalsignatur.dk:443

CONNECTED(00000003)
depth=2 /C=DK/O=TDC Internet/OU=TDC Internet Root CA
verify error:num=20:unable to get local issuer certificate
verify return:0
---
Certificate chain
 0 s:/C=DK/ST=Denmark/L=Copenhagen/O=IT & Telestyrelsen/OU=IT & Telestyrelsen/CN=www.digitalsignatur.dk
   i:/C=DK/O=TDC/OU=TDC SSL Server CA
-----BEGIN CERTIFICATE-----
MIIF5DCCBMygAwIBAgIEPix1iDANBgkqhkiG9w0BAQUFADA3MQswCQYDVQQGEwJE
SzEMMAoGA1UEChMDVERDMRowGAYDVQQLExFUREMgU1NMIFNlcnZlciBDQTAeFw0w
NzA4MDMxMjQ5NDdaFw0wOTEwMDgwNzQ4MzFaMIGPMQswCQYDVQQGEwJESzEQMA4G
A1UECBMHRGVubWFyazETMBEGA1UEBxMKQ29wZW5oYWdlbjEbMBkGA1UEChQSSVQg
JiBUZWxlc3R5cmVsc2VuMRswGQYDVQQLFBJJVCAmIFRlbGVzdHlyZWxzZW4xHzAd
BgNVBAMTFnd3dy5kaWdpdGFsc2lnbmF0dXIuZGswggEiMA0GCSqGSIb3DQEBAQUA
A4IBDwAwggEKAoIBAQCvUu8dz7+LEfvMb9WwBjgwmyKA0ihZYLPuZiEbEwhK/7Wv
7YrSZmfjjQIh1yqdJw7SLw0hv5RZYWimqFW4xXiuLpI0sTAJxCdTV/eeMem7bOiC
dfN1+yC8UtZPUJOkiGfpAt0AdqheAcU0vMMJd5ntqK9X8sw8h8b1XDHbFK57zhAP
bQ+zo8ieXfDcR7iMDLMD03TH+MU8CuRCear36YZ1pnmc3S/FzWWgsHhj65H2olTg
bZo+UzxRQUDYwWSE8qf4eJxNzD6KD5MgPoqAHrcvIqO4afqhJSz4e/1SiE54estC
pCVdwpsF0oNzD1lxJ6ekR+EPJ9jPYBgIBwH30C71AgMBAAGjggKdMIICmTALBgNV
HQ8EBAMCBaAwEQYJYIZIAYb4QgEBBAQDAgZAMIIBgAYDVR0gBIIBdzCCAXMwggFv
BgsrBgEEAaIiAgEBATCCAV4wLwYIKwYBBQUHAgEWI2h0dHA6Ly93d3cuY2VydGlm
aWthdC5kay9yZXBvc2l0b3J5MIIBKQYIKwYBBQUHAgIwggEbMBMWDFREQyBJbnRl
cm5ldDADAgEBGoIBAkRldHRlIGNlcnRpZmlrYXQgZXIgdWRzdGVkdCB1bmRlciBU
REMgSW50ZXJuZXQgQ0FzIENlcnRpZmlrYXQgUG9saXRpayBmb3IgU1NMIFNlcnZl
ciBjZXJ0aWZpa2F0ZXIgKE9JRD0xLjMuNi4xLjQuMS40Mzg2LjIuMS4xLjEpLiBU
aGlzIGNlcnRpZmljYXRlIGlzIGlzc3VlZCB1bmRlciBUREMgSW50ZXJuZXQgQ0Fz
IENlcnRpZmljYXRlIFBvbGljeSBmb3IgU1NMIFNlcnZlciBjZXJ0aWZpY2F0ZXMg
KE9JRD0xLjMuNi4xLjQuMS40Mzg2LjIuMS4xLjEpLjAdBgNVHSUEFjAUBggrBgEF
BQcDAQYIKwYBBQUHAwIwgYgGA1UdHwSBgDB+ME6gTKBKpEgwRjELMAkGA1UEBhMC
REsxDDAKBgNVBAoTA1REQzEaMBgGA1UECxMRVERDIFNTTCBTZXJ2ZXIgQ0ExDTAL
BgNVBAMTBENSTDUwLKAqoCiGJmh0dHA6Ly9jcmwuY2VydGlmaWthdC5kay9TU0xT
ZXJ2ZXIuY3JsMB8GA1UdIwQYMBaAFP0ewrMIOpXR1KWHzs1BhHPvM3QNMB0GA1Ud
DgQWBBSmEU1UoMDPNsbifEVXezHYiL6VzjAJBgNVHRMEAjAAMA0GCSqGSIb3DQEB
BQUAA4IBAQAfhgL26nxQsx+jMN8qTf+ItPAt6K+aT85jbI3iWTzzWRTVAMNlCJ5c
ekx/9kZdk38Z/EqiC/eX9iVkUBvlRio3kVKefF4uEA5qKuOxGecSRxQA/daCPnWl
DAcwrQYYRwzy6nV+6PhHXuKidAVn6gul1YhJCzIqAGhDQ+qrnJekRORICKx+uU8S
oBhUjOQX+ckCFlP22Fvg6MjpfUgskj/KWOVPdQVpovWyr31K0PZGdjjAmSiTPash
YCrXywVBretLP7zxMH2kBXPPcZJpd1bsGjfxXaC99BcKnMaPx77sr/BeMRUDgemH
jjF1Mjjomv+QQcyolfJMoG58CEdy49Ti
-----END CERTIFICATE-----
 1 s:/C=DK/O=TDC/OU=TDC SSL Server CA
   i:/C=DK/O=TDC Internet/OU=TDC Internet Root CA
-----BEGIN CERTIFICATE-----
MIIECjCCAvKgAwIBAgIEPBoC4jANBgkqhkiG9w0BAQUFADBDMQswCQYDVQQGEwJE
SzEVMBMGA1UEChMMVERDIEludGVybmV0MR0wGwYDVQQLExRUREMgSW50ZXJuZXQg
Um9vdCBDQTAeFw0wNjA5MjgxMDQwNTBaFw0xMTA5MjgxMTEwNTBaMDcxCzAJBgNV
BAYTAkRLMQwwCgYDVQQKEwNUREMxGjAYBgNVBAsTEVREQyBTU0wgU2VydmVyIENB
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA2ccg54uj7AKBZCwhFQbn
0ovjkDjjFw2pi1eMHlWqlHLm6dUMtfuL77fIkNUAFSurGfMFL1xoaXVaq5z4c7gC
G2pEkHdg3F4RHAOv6JvpbMDBRFLyNUgC6x9tk4YG9qGsGtDTljAT+ATKorFPszho
CP5SAKOGgnMY/MGoxYhOFjjc5+PfpqZNO5nG/FbzzB+lwrgEuwi6odMA92/2Zgi1
xRr0AxfnhkZPfKU9XHrLEsaPnk3DH2gXf1q++h4YMSwWX7Kqp+ffKA2wIIeKOZ33
bXNyMXjgi6EYQyALjCpZCdZX4ok9DSUEx1WXOy2AOrKMcMTF1vvJOxAQOJthyq0E
ewIDAQABo4IBEDCCAQwwgZMGA1UdHwSBizCBiDBaoFigVqRUMFIxCzAJBgNVBAYT
AkRLMRUwEwYDVQQKEwxUREMgSW50ZXJuZXQxHTAbBgNVBAsTFFREQyBJbnRlcm5l
dCBSb290IENBMQ0wCwYDVQQDEwRDUkwxMCqgKKAmhiRodHRwOi8vY3JsLmNlcnRp
ZmlrYXQuZGsvUm9vdF9DQS5jcmwwCwYDVR0PBAQDAgEGMB8GA1UdIwQYMBaAFGxk
Acf9hW2syNqeUAiFCLU8VqhQMB0GA1UdDgQWBBT9HsKzCDqV0dSlh87NQYRz7zN0
DTAMBgNVHRMEBTADAQH/MBkGCSqGSIb2fQdBAAQMMAobBFY2LjADAgSQMA0GCSqG
SIb3DQEBBQUAA4IBAQB+VBS3Zq0ssgJyK5rKWmT3acI6fEsYRrarBGVT5uRCmc5n
f/feHmvqWOcV34mLe9tupz4WajwAciJscRRPqG+4vqZ7IzBc9Ubs86Txe2U9ym+K
jiSzjzPdQZO1K9vhZAsREvmYE7LA2ehmjNgr+y9RJUME8xt/urVlIFKt8TuvK40K
lk1bPO6gKFSrNd16Lt4K9nKS4aXV9Gzhe95PQXDFl+JOT5dTZKW5o4n+KjSqyAvB
YMfKX+63Cu4ZKVcOjitVkFFins65Sic2gROLbl632kWIhX1qxnBFD3tzEs/4kIYQ
iF87CrLQg6VObcAWfnc6VKPwT0YOdNEVwG0ORkYM
-----END CERTIFICATE-----
 2 s:/C=DK/O=TDC Internet/OU=TDC Internet Root CA
   i:/C=US/O=Entrust.net/OU=www.entrust.net/CPS incorp. by ref. (limits liab.)/OU=(c) 1999 Entrust.net Limited/CN=Entrust.net Secure Server Certification Authority
-----BEGIN CERTIFICATE-----
MIIF/TCCBWagAwIBAgIEQobs8zANBgkqhkiG9w0BAQUFADCBwzELMAkGA1UEBhMC
VVMxFDASBgNVBAoTC0VudHJ1c3QubmV0MTswOQYDVQQLEzJ3d3cuZW50cnVzdC5u
ZXQvQ1BTIGluY29ycC4gYnkgcmVmLiAobGltaXRzIGxpYWIuKTElMCMGA1UECxMc
KGMpIDE5OTkgRW50cnVzdC5uZXQgTGltaXRlZDE6MDgGA1UEAxMxRW50cnVzdC5u
ZXQgU2VjdXJlIFNlcnZlciBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0wNjEw
MTIxODQ4NTJaFw0xMTEwMTIxOTE4NTJaMEMxCzAJBgNVBAYTAkRLMRUwEwYDVQQK
EwxUREMgSW50ZXJuZXQxHTAbBgNVBAsTFFREQyBJbnRlcm5ldCBSb290IENBMIIB
IjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxLhAvJHVYx/XmaCLDEAedLdI
nUaMArLgJF/wGROnN4NrXceO+YQwzho7+vvOi20jxsNuZp+Jpd/gQlBn+h9sHvTQ
Bda/ytZO5GhgbEaqHF1j4QeGDmUApy6mcca8uYGoOn0a0vnRrEvLznWv3Hv6gXPU
/Lq9QYjUdLP5Xjg6PEOo0pVOd20TDJ2PeAG3WiAfAzc14izbSysseLlJ28TQx5yc
5IogCSEWVmb/Bexb4/DPqyQkXsN/cHoSxNK1EKC2IeGNeGlVRGn1ypYcNIUXJXfi
9i8nmHj9eQY6otZaQ8H/7AQ77hPv01ha/5Lr7K7a8jcDR0G2l8ktCkEiu7vmpwID
AQABo4IC9zCCAvMwEgYDVR0TAQH/BAgwBgEB/wIBATAnBgNVHSUEIDAeBggrBgEF
BQcDAQYIKwYBBQUHAwIGCCsGAQUFBwMJMIIBLgYDVR0gBIIBJTCCASEwggEdBgkq
hkiG9n0HSwIwggEOMCYGCCsGAQUFBwIBFhpodHRwOi8vd3d3LmVudHJ1c3QubmV0
L2NwczCB4wYIKwYBBQUHAgIwgdYagdNGb3IgdXNlIHNvbGVseSB3aXRoIFNTTCBj
ZXJ0aWZpY2F0ZXMgaXNzdWVkIGJ5IFREQyBTb2x1dGlvbnMgQS9TIHRvIGF1dGhv
cml6ZWQgc3Vic2NyaWJlcnMuXFxyXFxuRE9FUyBOT1QgcmVwcmVzZW50IGFueSBl
bmRvcnNlbWVudCBieSBFbnRydXN0IEluYy4gb3IgaXRzIGFmZmlsaWF0ZXMgYXMg
dG8gdGhlIGlkZW50aXR5IG9mIGFueSBjZXJ0aWZpY2F0ZSBob2xkZXIuMIIBGAYD
VR0fBIIBDzCCAQswKKAmoCSGImh0dHA6Ly9jcmwuZW50cnVzdC5uZXQvc2VydmVy
MS5jcmwwgd6ggduggdikgdUwgdIxCzAJBgNVBAYTAlVTMRQwEgYDVQQKEwtFbnRy
dXN0Lm5ldDE7MDkGA1UECxMyd3d3LmVudHJ1c3QubmV0L0NQUyBpbmNvcnAuIGJ5
IHJlZi4gKGxpbWl0cyBsaWFiLikxJTAjBgNVBAsTHChjKSAxOTk5IEVudHJ1c3Qu
bmV0IExpbWl0ZWQxOjA4BgNVBAMTMUVudHJ1c3QubmV0IFNlY3VyZSBTZXJ2ZXIg
Q2VydGlmaWNhdGlvbiBBdXRob3JpdHkxDTALBgNVBAMTBENSTDEwCwYDVR0PBAQD
AgEGMB8GA1UdIwQYMBaAFPAXYhNVPbP/CgBr+1CEl/PtYtAaMB0GA1UdDgQWBBRs
ZAHH/YVtrMjanlAIhQi1PFaoUDAZBgkqhkiG9n0HQQAEDDAKGwRWNy4xAwIAgTAN
BgkqhkiG9w0BAQUFAAOBgQACKnOmebpCKJSVzmLtMnJUZT8lr4GYVqcd8GvSI7kw
IkBmdu6LpS2qiTT13Ol/8cLP2H4BohFyRFoOHDmDDBLua/2FJOopuMoKcHGs4wIS
LrHvp55O2Wxot2NVlYlAKWDUDfoopqgCMehJNfRoxWMykBQsZWcX/cLvmUvNZToM
2w==
-----END CERTIFICATE-----
---
Server certificate
subject=/C=DK/ST=Denmark/L=Copenhagen/O=IT & Telestyrelsen/OU=IT & Telestyrelsen/CN=www.digitalsignatur.dk
issuer=/C=DK/O=TDC/OU=TDC SSL Server CA
---
No client certificate CA names sent
---
SSL handshake has read 4229 bytes and written 443 bytes
---
New, TLSv1/SSLv3, Cipher is RC4-MD5
Server public key is 2048 bit
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1
    Cipher    : RC4-MD5
    Session-ID: 0C1F00006565DB37FA6FDE7DF84AE3A4D8BE99EA56E3BAFD22B8B2C12D7E61F9
    Session-ID-ctx:
    Master-Key: 0D9CF82D54AE2942CBACBA4C26687467743DCBFA6AADA581C6A023513976EDA84DB23F265A249EE46A372BE95CD98422
    Key-Arg   : None
    Krb5 Principal: None
    Start Time: 1222526140
    Timeout   : 300 (sec)
    Verify return code: 20 (unable to get local issuer certificate)
---

This gives a pretty straight answer that the Entrust chain is returned. Before digging into why IE/MS thinks otherwise I extract all the detailed certificate information with the openssl x509 command:

openssl x509 -text -in cert0.crt (having pasted the content into a file with that name)

which gives:

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 1043101064 (0x3e2c7588)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=DK, O=TDC, OU=TDC SSL Server CA
        Validity
            Not Before: Aug  3 12:49:47 2007 GMT
            Not After : Oct  8 07:48:31 2009 GMT
        Subject: C=DK, ST=Denmark, L=Copenhagen, O=IT & Telestyrelsen, OU=IT & Telestyrelsen, CN=www.digitalsignatur.dk
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
            RSA Public Key: (2048 bit)
                Modulus (2048 bit):
                    00:af:52:ef:1d:cf:bf:8b:11:fb:cc:6f:d5:b0:06:
                    38:30:9b:22:80:d2:28:59:60:b3:ee:66:21:1b:13:
                    08:4a:ff:b5:af:ed:8a:d2:66:67:e3:8d:02:21:d7:
                    2a:9d:27:0e:d2:2f:0d:21:bf:94:59:61:68:a6:a8:
                    55:b8:c5:78:ae:2e:92:34:b1:30:09:c4:27:53:57:
                    f7:9e:31:e9:bb:6c:e8:82:75:f3:75:fb:20:bc:52:
                    d6:4f:50:93:a4:88:67:e9:02:dd:00:76:a8:5e:01:
                    c5:34:bc:c3:09:77:99:ed:a8:af:57:f2:cc:3c:87:
                    c6:f5:5c:31:db:14:ae:7b:ce:10:0f:6d:0f:b3:a3:
                    c8:9e:5d:f0:dc:47:b8:8c:0c:b3:03:d3:74:c7:f8:
                    c5:3c:0a:e4:42:79:aa:f7:e9:86:75:a6:79:9c:dd:
                    2f:c5:cd:65:a0:b0:78:63:eb:91:f6:a2:54:e0:6d:
                    9a:3e:53:3c:51:41:40:d8:c1:64:84:f2:a7:f8:78:
                    9c:4d:cc:3e:8a:0f:93:20:3e:8a:80:1e:b7:2f:22:
                    a3:b8:69:fa:a1:25:2c:f8:7b:fd:52:88:4e:78:7a:
                    cb:42:a4:25:5d:c2:9b:05:d2:83:73:0f:59:71:27:
                    a7:a4:47:e1:0f:27:d8:cf:60:18:08:07:01:f7:d0:
                    2e:f5
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage:
                Digital Signature, Key Encipherment
            Netscape Cert Type:
                SSL Server
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4386.2.1.1.1
                  CPS: http://www.certifikat.dk/repository
                  User Notice:
                    Organization: TDC Internet
                    Number: 1
                    Explicit Text: Dette certifikat er udstedt under TDC Internet CAs Certifikat Politik for SSL Server certifikater (OID=1.3.6.1.4.1.4386.2.1.1.1). This certificate is issued under TDC Internet CAs Certificate Policy for SSL Server certificates (OID=1.3.6.1.4.1.4386.2.1.1.1).

            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                DirName:/C=DK/O=TDC/OU=TDC SSL Server CA/CN=CRL5
                URI:http://crl.certifikat.dk/SSLServer.crl

            X509v3 Authority Key Identifier:
                keyid:FD:1E:C2:B3:08:3A:95:D1:D4:A5:87:CE:CD:41:84:73:EF:33:74:0D

            X509v3 Subject Key Identifier:
                A6:11:4D:54:A0:C0:CF:36:C6:E2:7C:45:57:7B:31:D8:88:BE:95:CE
            X509v3 Basic Constraints:
                CA:FALSE
    Signature Algorithm: sha1WithRSAEncryption
        1f:86:02:f6:ea:7c:50:b3:1f:a3:30:df:2a:4d:ff:88:b4:f0:
        2d:e8:af:9a:4f:ce:63:6c:8d:e2:59:3c:f3:59:14:d5:00:c3:
        65:08:9e:5c:7a:4c:7f:f6:46:5d:93:7f:19:fc:4a:a2:0b:f7:
        97:f6:25:64:50:1b:e5:46:2a:37:91:52:9e:7c:5e:2e:10:0e:
        6a:2a:e3:b1:19:e7:12:47:14:00:fd:d6:82:3e:75:a5:0c:07:
        30:ad:06:18:47:0c:f2:ea:75:7e:e8:f8:47:5e:e2:a2:74:05:
        67:ea:0b:a5:d5:88:49:0b:32:2a:00:68:43:43:ea:ab:9c:97:
        a4:44:e4:48:08:ac:7e:b9:4f:12:a0:18:54:8c:e4:17:f9:c9:
        02:16:53:f6:d8:5b:e0:e8:c8:e9:7d:48:2c:92:3f:ca:58:e5:
        4f:75:05:69:a2:f5:b2:af:7d:4a:d0:f6:46:76:38:c0:99:28:
        93:3d:ab:21:60:2a:d7:cb:05:41:ad:eb:4b:3f:bc:f1:30:7d:
        a4:05:73:cf:71:92:69:77:56:ec:1a:37:f1:5d:a0:bd:f4:17:
        0a:9c:c6:8f:c7:be:ec:af:f0:5e:31:15:03:81:e9:87:8e:31:
        75:32:38:e8:9a:ff:90:41:cc:a8:95:f2:4c:a0:6e:7c:08:47:
        72:e3:d4:e2

and the next

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 1008337634 (0x3c1a02e2)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=DK, O=TDC Internet, OU=TDC Internet Root CA
        Validity
            Not Before: Sep 28 10:40:50 2006 GMT
            Not After : Sep 28 11:10:50 2011 GMT
        Subject: C=DK, O=TDC, OU=TDC SSL Server CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
            RSA Public Key: (2048 bit)
                Modulus (2048 bit):
                    00:d9:c7:20:e7:8b:a3:ec:02:81:64:2c:21:15:06:
                    e7:d2:8b:e3:90:38:e3:17:0d:a9:8b:57:8c:1e:55:
                    aa:94:72:e6:e9:d5:0c:b5:fb:8b:ef:b7:c8:90:d5:
                    00:15:2b:ab:19:f3:05:2f:5c:68:69:75:5a:ab:9c:
                    f8:73:b8:02:1b:6a:44:90:77:60:dc:5e:11:1c:03:
                    af:e8:9b:e9:6c:c0:c1:44:52:f2:35:48:02:eb:1f:
                    6d:93:86:06:f6:a1:ac:1a:d0:d3:96:30:13:f8:04:
                    ca:a2:b1:4f:b3:38:68:08:fe:52:00:a3:86:82:73:
                    18:fc:c1:a8:c5:88:4e:16:38:dc:e7:e3:df:a6:a6:
                    4d:3b:99:c6:fc:56:f3:cc:1f:a5:c2:b8:04:bb:08:
                    ba:a1:d3:00:f7:6f:f6:66:08:b5:c5:1a:f4:03:17:
                    e7:86:46:4f:7c:a5:3d:5c:7a:cb:12:c6:8f:9e:4d:
                    c3:1f:68:17:7f:5a:be:fa:1e:18:31:2c:16:5f:b2:
                    aa:a7:e7:df:28:0d:b0:20:87:8a:39:9d:f7:6d:73:
                    72:31:78:e0:8b:a1:18:43:20:0b:8c:2a:59:09:d6:
                    57:e2:89:3d:0d:25:04:c7:55:97:3b:2d:80:3a:b2:
                    8c:70:c4:c5:d6:fb:c9:3b:10:10:38:9b:61:ca:ad:
                    04:7b
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 CRL Distribution Points:
                DirName:/C=DK/O=TDC Internet/OU=TDC Internet Root CA/CN=CRL1
                URI:http://crl.certifikat.dk/Root_CA.crl

            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Authority Key Identifier:
                keyid:6C:64:01:C7:FD:85:6D:AC:C8:DA:9E:50:08:85:08:B5:3C:56:A8:50

            X509v3 Subject Key Identifier:
                FD:1E:C2:B3:08:3A:95:D1:D4:A5:87:CE:CD:41:84:73:EF:33:74:0D
            X509v3 Basic Constraints:
                CA:TRUE
            1.2.840.113533.7.65.0:
                0
..V6.0....
    Signature Algorithm: sha1WithRSAEncryption
        7e:54:14:b7:66:ad:2c:b2:02:72:2b:9a:ca:5a:64:f7:69:c2:
        3a:7c:4b:18:46:b6:ab:04:65:53:e6:e4:42:99:ce:67:7f:f7:
        de:1e:6b:ea:58:e7:15:df:89:8b:7b:db:6e:a7:3e:16:6a:3c:
        00:72:22:6c:71:14:4f:a8:6f:b8:be:a6:7b:23:30:5c:f5:46:
        ec:f3:a4:f1:7b:65:3d:ca:6f:8a:8e:24:b3:8f:33:dd:41:93:
        b5:2b:db:e1:64:0b:11:12:f9:98:13:b2:c0:d9:e8:66:8c:d8:
        2b:fb:2f:51:25:43:04:f3:1b:7f:ba:b5:65:20:52:ad:f1:3b:
        af:2b:8d:0a:96:4d:5b:3c:ee:a0:28:54:ab:35:dd:7a:2e:de:
        0a:f6:72:92:e1:a5:d5:f4:6c:e1:7b:de:4f:41:70:c5:97:e2:
        4e:4f:97:53:64:a5:b9:a3:89:fe:2a:34:aa:c8:0b:c1:60:c7:
        ca:5f:ee:b7:0a:ee:19:29:57:0e:8e:2b:55:90:51:62:9e:ce:
        b9:4a:27:36:81:13:8b:6e:5e:b7:da:45:88:85:7d:6a:c6:70:
        45:0f:7b:73:12:cf:f8:90:86:10:88:5f:3b:0a:b2:d0:83:a5:
        4e:6d:c0:16:7e:77:3a:54:a3:f0:4f:46:0e:74:d1:15:c0:6d:
        0e:46:46:0c

a the final one:

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 1116138739 (0x4286ecf3)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, O=Entrust.net, OU=www.entrust.net/CPS incorp. by ref. (limits liab.), OU=(c) 1999 Entrust.net Limited, CN=Entrust.net Secure Server Certification Authority
        Validity
            Not Before: Oct 12 18:48:52 2006 GMT
            Not After : Oct 12 19:18:52 2011 GMT
        Subject: C=DK, O=TDC Internet, OU=TDC Internet Root CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
            RSA Public Key: (2048 bit)
                Modulus (2048 bit):
                    00:c4:b8:40:bc:91:d5:63:1f:d7:99:a0:8b:0c:40:
                    1e:74:b7:48:9d:46:8c:02:b2:e0:24:5f:f0:19:13:
                    a7:37:83:6b:5d:c7:8e:f9:84:30:ce:1a:3b:fa:fb:
                    ce:8b:6d:23:c6:c3:6e:66:9f:89:a5:df:e0:42:50:
                    67:fa:1f:6c:1e:f4:d0:05:d6:bf:ca:d6:4e:e4:68:
                    60:6c:46:aa:1c:5d:63:e1:07:86:0e:65:00:a7:2e:
                    a6:71:c6:bc:b9:81:a8:3a:7d:1a:d2:f9:d1:ac:4b:
                    cb:ce:75:af:dc:7b:fa:81:73:d4:fc:ba:bd:41:88:
                    d4:74:b3:f9:5e:38:3a:3c:43:a8:d2:95:4e:77:6d:
                    13:0c:9d:8f:78:01:b7:5a:20:1f:03:37:35:e2:2c:
                    db:4b:2b:2c:78:b9:49:db:c4:d0:c7:9c:9c:e4:8a:
                    20:09:21:16:56:66:ff:05:ec:5b:e3:f0:cf:ab:24:
                    24:5e:c3:7f:70:7a:12:c4:d2:b5:10:a0:b6:21:e1:
                    8d:78:69:55:44:69:f5:ca:96:1c:34:85:17:25:77:
                    e2:f6:2f:27:98:78:fd:79:06:3a:a2:d6:5a:43:c1:
                    ff:ec:04:3b:ee:13:ef:d3:58:5a:ff:92:eb:ec:ae:
                    da:f2:37:03:47:41:b6:97:c9:2d:0a:41:22:bb:bb:
                    e6:a7
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
            X509v3 Certificate Policies:
                Policy: 1.2.840.113533.7.75.2
                  CPS: http://www.entrust.net/cps
                  User Notice:
                    Explicit Text: For use solely with SSL certificates issued by TDC Solutions A/S to authorized subscribers.\\r\\nDOES NOT represent any endorsement by Entrust Inc. or its affiliates as to the identity of any certificate holder.

            X509v3 CRL Distribution Points:
                URI:http://crl.entrust.net/server1.crl
                DirName:/C=US/O=Entrust.net/OU=www.entrust.net/CPS incorp. by ref. (limits liab.)/OU=(c) 1999 Entrust.net Limited/CN=Entrust.net Secure Server Certification Authority/CN=CRL1

            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Authority Key Identifier:
                keyid:F0:17:62:13:55:3D:B3:FF:0A:00:6B:FB:50:84:97:F3:ED:62:D0:1A

            X509v3 Subject Key Identifier:
                6C:64:01:C7:FD:85:6D:AC:C8:DA:9E:50:08:85:08:B5:3C:56:A8:50
            1.2.840.113533.7.65.0:
                0
..V7.1....
    Signature Algorithm: sha1WithRSAEncryption
        02:2a:73:a6:79:ba:42:28:94:95:ce:62:ed:32:72:54:65:3f:
        25:af:81:98:56:a7:1d:f0:6b:d2:23:b9:30:22:40:66:76:ee:
        8b:a5:2d:aa:89:34:f5:dc:e9:7f:f1:c2:cf:d8:7e:01:a2:11:
        72:44:5a:0e:1c:39:83:0c:12:ee:6b:fd:85:24:ea:29:b8:ca:
        0a:70:71:ac:e3:02:12:2e:b1:ef:a7:9e:4e:d9:6c:68:b7:63:
        55:95:89:40:29:60:d4:0d:fa:28:a6:a8:02:31:e8:49:35:f4:
        68:c5:63:32:90:14:2c:65:67:17:fd:c2:ef:99:4b:cd:65:3a:
        0c:db

The Certificate chain recommended by TDC

On the site for rootcertificates the complete certificate chain that can be used in an Apache HTTPD webserver:

#tdcssl-tdcroot:
-----BEGIN CERTIFICATE-----
MIIECjCCAvKgAwIBAgIEPBoC4jANBgkqhkiG9w0BAQUFADBDMQswCQYDVQQGEwJE
SzEVMBMGA1UEChMMVERDIEludGVybmV0MR0wGwYDVQQLExRUREMgSW50ZXJuZXQg
Um9vdCBDQTAeFw0wNjA5MjgxMDQwNTBaFw0xMTA5MjgxMTEwNTBaMDcxCzAJBgNV
BAYTAkRLMQwwCgYDVQQKEwNUREMxGjAYBgNVBAsTEVREQyBTU0wgU2VydmVyIENB
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA2ccg54uj7AKBZCwhFQbn
0ovjkDjjFw2pi1eMHlWqlHLm6dUMtfuL77fIkNUAFSurGfMFL1xoaXVaq5z4c7gC
G2pEkHdg3F4RHAOv6JvpbMDBRFLyNUgC6x9tk4YG9qGsGtDTljAT+ATKorFPszho
CP5SAKOGgnMY/MGoxYhOFjjc5+PfpqZNO5nG/FbzzB+lwrgEuwi6odMA92/2Zgi1
xRr0AxfnhkZPfKU9XHrLEsaPnk3DH2gXf1q++h4YMSwWX7Kqp+ffKA2wIIeKOZ33
bXNyMXjgi6EYQyALjCpZCdZX4ok9DSUEx1WXOy2AOrKMcMTF1vvJOxAQOJthyq0E
ewIDAQABo4IBEDCCAQwwgZMGA1UdHwSBizCBiDBaoFigVqRUMFIxCzAJBgNVBAYT
AkRLMRUwEwYDVQQKEwxUREMgSW50ZXJuZXQxHTAbBgNVBAsTFFREQyBJbnRlcm5l
dCBSb290IENBMQ0wCwYDVQQDEwRDUkwxMCqgKKAmhiRodHRwOi8vY3JsLmNlcnRp
ZmlrYXQuZGsvUm9vdF9DQS5jcmwwCwYDVR0PBAQDAgEGMB8GA1UdIwQYMBaAFGxk
Acf9hW2syNqeUAiFCLU8VqhQMB0GA1UdDgQWBBT9HsKzCDqV0dSlh87NQYRz7zN0
DTAMBgNVHRMEBTADAQH/MBkGCSqGSIb2fQdBAAQMMAobBFY2LjADAgSQMA0GCSqG
SIb3DQEBBQUAA4IBAQB+VBS3Zq0ssgJyK5rKWmT3acI6fEsYRrarBGVT5uRCmc5n
f/feHmvqWOcV34mLe9tupz4WajwAciJscRRPqG+4vqZ7IzBc9Ubs86Txe2U9ym+K
jiSzjzPdQZO1K9vhZAsREvmYE7LA2ehmjNgr+y9RJUME8xt/urVlIFKt8TuvK40K
lk1bPO6gKFSrNd16Lt4K9nKS4aXV9Gzhe95PQXDFl+JOT5dTZKW5o4n+KjSqyAvB
YMfKX+63Cu4ZKVcOjitVkFFins65Sic2gROLbl632kWIhX1qxnBFD3tzEs/4kIYQ
iF87CrLQg6VObcAWfnc6VKPwT0YOdNEVwG0ORkYM
-----END CERTIFICATE-----
#tdcroot-entrustssl:
-----BEGIN CERTIFICATE-----
MIIF/TCCBWagAwIBAgIEQobs8zANBgkqhkiG9w0BAQUFADCBwzELMAkGA1UEBhMC
VVMxFDASBgNVBAoTC0VudHJ1c3QubmV0MTswOQYDVQQLEzJ3d3cuZW50cnVzdC5u
ZXQvQ1BTIGluY29ycC4gYnkgcmVmLiAobGltaXRzIGxpYWIuKTElMCMGA1UECxMc
KGMpIDE5OTkgRW50cnVzdC5uZXQgTGltaXRlZDE6MDgGA1UEAxMxRW50cnVzdC5u
ZXQgU2VjdXJlIFNlcnZlciBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0wNjEw
MTIxODQ4NTJaFw0xMTEwMTIxOTE4NTJaMEMxCzAJBgNVBAYTAkRLMRUwEwYDVQQK
EwxUREMgSW50ZXJuZXQxHTAbBgNVBAsTFFREQyBJbnRlcm5ldCBSb290IENBMIIB
IjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxLhAvJHVYx/XmaCLDEAedLdI
nUaMArLgJF/wGROnN4NrXceO+YQwzho7+vvOi20jxsNuZp+Jpd/gQlBn+h9sHvTQ
Bda/ytZO5GhgbEaqHF1j4QeGDmUApy6mcca8uYGoOn0a0vnRrEvLznWv3Hv6gXPU
/Lq9QYjUdLP5Xjg6PEOo0pVOd20TDJ2PeAG3WiAfAzc14izbSysseLlJ28TQx5yc
5IogCSEWVmb/Bexb4/DPqyQkXsN/cHoSxNK1EKC2IeGNeGlVRGn1ypYcNIUXJXfi
9i8nmHj9eQY6otZaQ8H/7AQ77hPv01ha/5Lr7K7a8jcDR0G2l8ktCkEiu7vmpwID
AQABo4IC9zCCAvMwEgYDVR0TAQH/BAgwBgEB/wIBATAnBgNVHSUEIDAeBggrBgEF
BQcDAQYIKwYBBQUHAwIGCCsGAQUFBwMJMIIBLgYDVR0gBIIBJTCCASEwggEdBgkq
hkiG9n0HSwIwggEOMCYGCCsGAQUFBwIBFhpodHRwOi8vd3d3LmVudHJ1c3QubmV0
L2NwczCB4wYIKwYBBQUHAgIwgdYagdNGb3IgdXNlIHNvbGVseSB3aXRoIFNTTCBj
ZXJ0aWZpY2F0ZXMgaXNzdWVkIGJ5IFREQyBTb2x1dGlvbnMgQS9TIHRvIGF1dGhv
cml6ZWQgc3Vic2NyaWJlcnMuXFxyXFxuRE9FUyBOT1QgcmVwcmVzZW50IGFueSBl
bmRvcnNlbWVudCBieSBFbnRydXN0IEluYy4gb3IgaXRzIGFmZmlsaWF0ZXMgYXMg
dG8gdGhlIGlkZW50aXR5IG9mIGFueSBjZXJ0aWZpY2F0ZSBob2xkZXIuMIIBGAYD
VR0fBIIBDzCCAQswKKAmoCSGImh0dHA6Ly9jcmwuZW50cnVzdC5uZXQvc2VydmVy
MS5jcmwwgd6ggduggdikgdUwgdIxCzAJBgNVBAYTAlVTMRQwEgYDVQQKEwtFbnRy
dXN0Lm5ldDE7MDkGA1UECxMyd3d3LmVudHJ1c3QubmV0L0NQUyBpbmNvcnAuIGJ5
IHJlZi4gKGxpbWl0cyBsaWFiLikxJTAjBgNVBAsTHChjKSAxOTk5IEVudHJ1c3Qu
bmV0IExpbWl0ZWQxOjA4BgNVBAMTMUVudHJ1c3QubmV0IFNlY3VyZSBTZXJ2ZXIg
Q2VydGlmaWNhdGlvbiBBdXRob3JpdHkxDTALBgNVBAMTBENSTDEwCwYDVR0PBAQD
AgEGMB8GA1UdIwQYMBaAFPAXYhNVPbP/CgBr+1CEl/PtYtAaMB0GA1UdDgQWBBRs
ZAHH/YVtrMjanlAIhQi1PFaoUDAZBgkqhkiG9n0HQQAEDDAKGwRWNy4xAwIAgTAN
BgkqhkiG9w0BAQUFAAOBgQACKnOmebpCKJSVzmLtMnJUZT8lr4GYVqcd8GvSI7kw
IkBmdu6LpS2qiTT13Ol/8cLP2H4BohFyRFoOHDmDDBLua/2FJOopuMoKcHGs4wIS
LrHvp55O2Wxot2NVlYlAKWDUDfoopqgCMehJNfRoxWMykBQsZWcX/cLvmUvNZToM
2w==
-----END CERTIFICATE-----
#entrustssl-entrustssl
-----BEGIN CERTIFICATE-----
MIIE2DCCBEGgAwIBAgIEN0rSQzANBgkqhkiG9w0BAQUFADCBwzELMAkGA1UEBhMC
VVMxFDASBgNVBAoTC0VudHJ1c3QubmV0MTswOQYDVQQLEzJ3d3cuZW50cnVzdC5u
ZXQvQ1BTIGluY29ycC4gYnkgcmVmLiAobGltaXRzIGxpYWIuKTElMCMGA1UECxMc
KGMpIDE5OTkgRW50cnVzdC5uZXQgTGltaXRlZDE6MDgGA1UEAxMxRW50cnVzdC5u
ZXQgU2VjdXJlIFNlcnZlciBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw05OTA1
MjUxNjA5NDBaFw0xOTA1MjUxNjM5NDBaMIHDMQswCQYDVQQGEwJVUzEUMBIGA1UE
ChMLRW50cnVzdC5uZXQxOzA5BgNVBAsTMnd3dy5lbnRydXN0Lm5ldC9DUFMgaW5j
b3JwLiBieSByZWYuIChsaW1pdHMgbGlhYi4pMSUwIwYDVQQLExwoYykgMTk5OSBF
bnRydXN0Lm5ldCBMaW1pdGVkMTowOAYDVQQDEzFFbnRydXN0Lm5ldCBTZWN1cmUg
U2VydmVyIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MIGdMA0GCSqGSIb3DQEBAQUA
A4GLADCBhwKBgQDNKIM0VBuJ8w+vN5Ex/68xYMmo6LIQaO2f55M28Qpku0f1BBc/
I0dNxScZgSYMVHINiC3ZH5oSn7yzcdOAGT9HZnuMNSjSuQrfJNqc1lB5gXpa0zf3
wkrYKZImZNHkmGw6AIr1NJtl+O3jEP/9uElY3KDegjlrgbEWGWG5VLbmQwIBA6OC
AdcwggHTMBEGCWCGSAGG+EIBAQQEAwIABzCCARkGA1UdHwSCARAwggEMMIHeoIHb
oIHYpIHVMIHSMQswCQYDVQQGEwJVUzEUMBIGA1UEChMLRW50cnVzdC5uZXQxOzA5
BgNVBAsTMnd3dy5lbnRydXN0Lm5ldC9DUFMgaW5jb3JwLiBieSByZWYuIChsaW1p
dHMgbGlhYi4pMSUwIwYDVQQLExwoYykgMTk5OSBFbnRydXN0Lm5ldCBMaW1pdGVk
MTowOAYDVQQDEzFFbnRydXN0Lm5ldCBTZWN1cmUgU2VydmVyIENlcnRpZmljYXRp
b24gQXV0aG9yaXR5MQ0wCwYDVQQDEwRDUkwxMCmgJ6AlhiNodHRwOi8vd3d3LmVu
dHJ1c3QubmV0L0NSTC9uZXQxLmNybDArBgNVHRAEJDAigA8xOTk5MDUyNTE2MDk0
MFqBDzIwMTkwNTI1MTYwOTQwWjALBgNVHQ8EBAMCAQYwHwYDVR0jBBgwFoAU8Bdi
E1U9s/8KAGv7UISX8+1i0BowHQYDVR0OBBYEFPAXYhNVPbP/CgBr+1CEl/PtYtAa
MAwGA1UdEwQFMAMBAf8wGQYJKoZIhvZ9B0EABAwwChsEVjQuMAMCBJAwDQYJKoZI
hvcNAQEFBQADgYEAkNwwAvpkdMKnCqV8IY00F6j7Rw7/JXyNEwr75Ji174z4xRAN
95K+8cPV1ZVqBLssziY2ZcgxxufuP+NXdYR6Ee9GTxj005i7qIcyunL2POI9n9cd
2cNgQ4xYDiKWL2KjLB+6rQXvqzJ4h6BUcxm1XAX5Uj5tLUUL9wqT6u0G+bI=
-----END CERTIFICATE-----

the humanreadble version is something like:

#tdcssl-tdcroot:
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 1008337634 (0x3c1a02e2)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=DK, O=TDC Internet, OU=TDC Internet Root CA
        Validity
            Not Before: Sep 28 10:40:50 2006 GMT
            Not After : Sep 28 11:10:50 2011 GMT
        Subject: C=DK, O=TDC, OU=TDC SSL Server CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
            RSA Public Key: (2048 bit)
                Modulus (2048 bit):
                    00:d9:c7:20:e7:8b:a3:ec:02:81:64:2c:21:15:06:
                    e7:d2:8b:e3:90:38:e3:17:0d:a9:8b:57:8c:1e:55:
                    aa:94:72:e6:e9:d5:0c:b5:fb:8b:ef:b7:c8:90:d5:
                    00:15:2b:ab:19:f3:05:2f:5c:68:69:75:5a:ab:9c:
                    f8:73:b8:02:1b:6a:44:90:77:60:dc:5e:11:1c:03:
                    af:e8:9b:e9:6c:c0:c1:44:52:f2:35:48:02:eb:1f:
                    6d:93:86:06:f6:a1:ac:1a:d0:d3:96:30:13:f8:04:
                    ca:a2:b1:4f:b3:38:68:08:fe:52:00:a3:86:82:73:
                    18:fc:c1:a8:c5:88:4e:16:38:dc:e7:e3:df:a6:a6:
                    4d:3b:99:c6:fc:56:f3:cc:1f:a5:c2:b8:04:bb:08:
                    ba:a1:d3:00:f7:6f:f6:66:08:b5:c5:1a:f4:03:17:
                    e7:86:46:4f:7c:a5:3d:5c:7a:cb:12:c6:8f:9e:4d:
                    c3:1f:68:17:7f:5a:be:fa:1e:18:31:2c:16:5f:b2:
                    aa:a7:e7:df:28:0d:b0:20:87:8a:39:9d:f7:6d:73:
                    72:31:78:e0:8b:a1:18:43:20:0b:8c:2a:59:09:d6:
                    57:e2:89:3d:0d:25:04:c7:55:97:3b:2d:80:3a:b2:
                    8c:70:c4:c5:d6:fb:c9:3b:10:10:38:9b:61:ca:ad:
                    04:7b
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 CRL Distribution Points:
                DirName:/C=DK/O=TDC Internet/OU=TDC Internet Root CA/CN=CRL1
                URI:http://crl.certifikat.dk/Root_CA.crl

            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Authority Key Identifier:
                keyid:6C:64:01:C7:FD:85:6D:AC:C8:DA:9E:50:08:85:08:B5:3C:56:A8:50

            X509v3 Subject Key Identifier:
                FD:1E:C2:B3:08:3A:95:D1:D4:A5:87:CE:CD:41:84:73:EF:33:74:0D
            X509v3 Basic Constraints:
                CA:TRUE
            1.2.840.113533.7.65.0:
                0
..V6.0....
    Signature Algorithm: sha1WithRSAEncryption
        7e:54:14:b7:66:ad:2c:b2:02:72:2b:9a:ca:5a:64:f7:69:c2:
        3a:7c:4b:18:46:b6:ab:04:65:53:e6:e4:42:99:ce:67:7f:f7:
        de:1e:6b:ea:58:e7:15:df:89:8b:7b:db:6e:a7:3e:16:6a:3c:
        00:72:22:6c:71:14:4f:a8:6f:b8:be:a6:7b:23:30:5c:f5:46:
        ec:f3:a4:f1:7b:65:3d:ca:6f:8a:8e:24:b3:8f:33:dd:41:93:
        b5:2b:db:e1:64:0b:11:12:f9:98:13:b2:c0:d9:e8:66:8c:d8:
        2b:fb:2f:51:25:43:04:f3:1b:7f:ba:b5:65:20:52:ad:f1:3b:
        af:2b:8d:0a:96:4d:5b:3c:ee:a0:28:54:ab:35:dd:7a:2e:de:
        0a:f6:72:92:e1:a5:d5:f4:6c:e1:7b:de:4f:41:70:c5:97:e2:
        4e:4f:97:53:64:a5:b9:a3:89:fe:2a:34:aa:c8:0b:c1:60:c7:
        ca:5f:ee:b7:0a:ee:19:29:57:0e:8e:2b:55:90:51:62:9e:ce:
        b9:4a:27:36:81:13:8b:6e:5e:b7:da:45:88:85:7d:6a:c6:70:
        45:0f:7b:73:12:cf:f8:90:86:10:88:5f:3b:0a:b2:d0:83:a5:
        4e:6d:c0:16:7e:77:3a:54:a3:f0:4f:46:0e:74:d1:15:c0:6d:
        0e:46:46:0c

#tdcroot-entrustssl:
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 1116138739 (0x4286ecf3)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, O=Entrust.net, OU=www.entrust.net/CPS incorp. by ref. (limits liab.), OU=(c) 1999 Entrust.net Limited, CN=Entrust.net Secure Server Certification Authority
        Validity
            Not Before: Oct 12 18:48:52 2006 GMT
            Not After : Oct 12 19:18:52 2011 GMT
        Subject: C=DK, O=TDC Internet, OU=TDC Internet Root CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
            RSA Public Key: (2048 bit)
                Modulus (2048 bit):
                    00:c4:b8:40:bc:91:d5:63:1f:d7:99:a0:8b:0c:40:
                    1e:74:b7:48:9d:46:8c:02:b2:e0:24:5f:f0:19:13:
                    a7:37:83:6b:5d:c7:8e:f9:84:30:ce:1a:3b:fa:fb:
                    ce:8b:6d:23:c6:c3:6e:66:9f:89:a5:df:e0:42:50:
                    67:fa:1f:6c:1e:f4:d0:05:d6:bf:ca:d6:4e:e4:68:
                    60:6c:46:aa:1c:5d:63:e1:07:86:0e:65:00:a7:2e:
                    a6:71:c6:bc:b9:81:a8:3a:7d:1a:d2:f9:d1:ac:4b:
                    cb:ce:75:af:dc:7b:fa:81:73:d4:fc:ba:bd:41:88:
                    d4:74:b3:f9:5e:38:3a:3c:43:a8:d2:95:4e:77:6d:
                    13:0c:9d:8f:78:01:b7:5a:20:1f:03:37:35:e2:2c:
                    db:4b:2b:2c:78:b9:49:db:c4:d0:c7:9c:9c:e4:8a:
                    20:09:21:16:56:66:ff:05:ec:5b:e3:f0:cf:ab:24:
                    24:5e:c3:7f:70:7a:12:c4:d2:b5:10:a0:b6:21:e1:
                    8d:78:69:55:44:69:f5:ca:96:1c:34:85:17:25:77:
                    e2:f6:2f:27:98:78:fd:79:06:3a:a2:d6:5a:43:c1:
                    ff:ec:04:3b:ee:13:ef:d3:58:5a:ff:92:eb:ec:ae:
                    da:f2:37:03:47:41:b6:97:c9:2d:0a:41:22:bb:bb:
                    e6:a7
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
            X509v3 Certificate Policies:
                Policy: 1.2.840.113533.7.75.2
                  CPS: http://www.entrust.net/cps
                  User Notice:
                    Explicit Text: For use solely with SSL certificates issued by TDC Solutions A/S to authorized subscribers.\\r\\nDOES NOT represent any endorsement by Entrust Inc. or its affiliates as to the identity of any certificate holder.

            X509v3 CRL Distribution Points:
                URI:http://crl.entrust.net/server1.crl
                DirName:/C=US/O=Entrust.net/OU=www.entrust.net/CPS incorp. by ref. (limits liab.)/OU=(c) 1999 Entrust.net Limited/CN=Entrust.net Secure Server Certification Authority/CN=CRL1

            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Authority Key Identifier:
                keyid:F0:17:62:13:55:3D:B3:FF:0A:00:6B:FB:50:84:97:F3:ED:62:D0:1A

            X509v3 Subject Key Identifier:
                6C:64:01:C7:FD:85:6D:AC:C8:DA:9E:50:08:85:08:B5:3C:56:A8:50
            1.2.840.113533.7.65.0:
                0
..V7.1....
    Signature Algorithm: sha1WithRSAEncryption
        02:2a:73:a6:79:ba:42:28:94:95:ce:62:ed:32:72:54:65:3f:
        25:af:81:98:56:a7:1d:f0:6b:d2:23:b9:30:22:40:66:76:ee:
        8b:a5:2d:aa:89:34:f5:dc:e9:7f:f1:c2:cf:d8:7e:01:a2:11:
        72:44:5a:0e:1c:39:83:0c:12:ee:6b:fd:85:24:ea:29:b8:ca:
        0a:70:71:ac:e3:02:12:2e:b1:ef:a7:9e:4e:d9:6c:68:b7:63:
        55:95:89:40:29:60:d4:0d:fa:28:a6:a8:02:31:e8:49:35:f4:
        68:c5:63:32:90:14:2c:65:67:17:fd:c2:ef:99:4b:cd:65:3a:
        0c:db

#entrustssl-entrustssl
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 927650371 (0x374ad243)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, O=Entrust.net, OU=www.entrust.net/CPS incorp. by ref. (limits liab.), OU=(c) 1999 Entrust.net Limited, CN=Entrust.net Secure Server Certification Authority
        Validity
            Not Before: May 25 16:09:40 1999 GMT
            Not After : May 25 16:39:40 2019 GMT
        Subject: C=US, O=Entrust.net, OU=www.entrust.net/CPS incorp. by ref. (limits liab.), OU=(c) 1999 Entrust.net Limited, CN=Entrust.net Secure Server Certification Authority
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
            RSA Public Key: (1024 bit)
                Modulus (1024 bit):
                    00:cd:28:83:34:54:1b:89:f3:0f:af:37:91:31:ff:
                    af:31:60:c9:a8:e8:b2:10:68:ed:9f:e7:93:36:f1:
                    0a:64:bb:47:f5:04:17:3f:23:47:4d:c5:27:19:81:
                    26:0c:54:72:0d:88:2d:d9:1f:9a:12:9f:bc:b3:71:
                    d3:80:19:3f:47:66:7b:8c:35:28:d2:b9:0a:df:24:
                    da:9c:d6:50:79:81:7a:5a:d3:37:f7:c2:4a:d8:29:
                    92:26:64:d1:e4:98:6c:3a:00:8a:f5:34:9b:65:f8:
                    ed:e3:10:ff:fd:b8:49:58:dc:a0:de:82:39:6b:81:
                    b1:16:19:61:b9:54:b6:e6:43
                Exponent: 3 (0x3)
        X509v3 extensions:
            Netscape Cert Type:
                SSL CA, S/MIME CA, Object Signing CA
            X509v3 CRL Distribution Points:
                DirName:/C=US/O=Entrust.net/OU=www.entrust.net/CPS incorp. by ref. (limits liab.)/OU=(c) 1999 Entrust.net Limited/CN=Entrust.net Secure Server Certification Authority/CN=CRL1
                URI:http://www.entrust.net/CRL/net1.crl

            X509v3 Private Key Usage Period:
                Not Before: May 25 16:09:40 1999 GMT, Not After: May 25 16:09:40 2019 GMT
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Authority Key Identifier:
                keyid:F0:17:62:13:55:3D:B3:FF:0A:00:6B:FB:50:84:97:F3:ED:62:D0:1A

            X509v3 Subject Key Identifier:
                F0:17:62:13:55:3D:B3:FF:0A:00:6B:FB:50:84:97:F3:ED:62:D0:1A
            X509v3 Basic Constraints:
                CA:TRUE
            1.2.840.113533.7.65.0:
                0
..V4.0....
    Signature Algorithm: sha1WithRSAEncryption
        90:dc:30:02:fa:64:74:c2:a7:0a:a5:7c:21:8d:34:17:a8:fb:
        47:0e:ff:25:7c:8d:13:0a:fb:e4:98:b5:ef:8c:f8:c5:10:0d:
        f7:92:be:f1:c3:d5:d5:95:6a:04:bb:2c:ce:26:36:65:c8:31:
        c6:e7:ee:3f:e3:57:75:84:7a:11:ef:46:4f:18:f4:d3:98:bb:
        a8:87:32:ba:72:f6:3c:e2:3d:9f:d7:1d:d9:c3:60:43:8c:58:
        0e:22:96:2f:62:a3:2c:1f:ba:ad:05:ef:ab:32:78:87:a0:54:
        73:19:b5:5c:05:f9:52:3e:6d:2d:45:0b:f7:0a:93:ea:ed:06:
        f9:b2

Want can I conclude?

That the view in firefox, OpenSSL and DigiCert seems right and that IE will display the same when the old root certificate is removed from the certificate store. At present I can't tell the exact reason for whats going on here, but i you known I'll be glad to hear of it!

The UserAgent Signature from the Google Chrome browser

I guess many of us with access to webserver logs or tracking tools have looked curiously after the first visitors using the brand new Google Chrome browser - but what should we look for?

I just did a quick check and here's a log entry on an Apache2 HTTP server, when i visit it with my new installed Chrome browser on Windows XP:

*.*.*.* - - [03/Sep/2008:17:02:49 +0200] 
"GET / HTTP/1.1" 200 17237 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/525.13 (KHTML, like Gecko) Chrome/0.2.149.27 Safari/525.13"

which with my Firefox2 browser would be like:

*.*.*.* - - [03/Sep/2008:17:26:23 +0200] 
"GET / HTTP/1.1" 200 15101 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.16) Gecko/20080702 Firefox/2.0.0.16"

There's not much to conclude except that the main browing capability Mozilla/5.0 is the same. A more odd observation is that whereas Chrome is still struggling to get to the infantil version 0.3 the AppleWebKit is much more mature with the three digit version 525.13.

My personal opinion on Chrome is that it's much like firefox (and IE) and I'm not are heavy user of complex AJAX sites, so I'm not expected feel much difference. The load times are fine, but I miss my favorite addons and I haven't had time to check the featureset more closely. By the way this is my first blogentry done with Chrome.

The <noscript> can't follow <script> everywhere - the unfortunate life as a block level element

A new day and a new finding on the good ol' (x)html. I've just all ways assumed that the <noscript> tag could be used with <script> - but I was wrong, taught by doing validation myself! The <noscript> tag is restricted to block level wheres <script> can be used inline as well. The implication is that if you care for validity you'll have to look out for it, though the interaction between scriptet and non-scriptet parts can vary greatly and probably you'll all ways be able to find a way thorugh.

I'll start the investigation by getting the terms defined. In the HTML 4.01 specification section 7.5.3 " Block-level and inline elements":

Certain HTML elements that may appear in BODY are said to be "block-level" while others are "inline" (also known as "text level"). The distinction is founded on several notions:

Content model

Generally, block-level elements may contain inline elements and other block-level elements. Generally, inline elements may contain only data and other inline elements. Inherent in this structural distinction is the idea that block elements create "larger" structures than inline elements.

Formatting

By default, block-level elements are formatted differently than inline elements. Generally, block-level elements begin on new lines, inline elements do not. For information about white space, line breaks, and block formatting, please consult the section on text.

Directionality

For technical reasons involving the [UNICODE] bidirectional text algorithm, block-level and inline elements differ in how they inherit directionality information. For details, see the section on inheritance of text direction.

so the real problem for <noscript> is not that it's a block-level element, since that makes it possible to embed full markup inside, but rather that it's not an inline element since that restricts where it can placed itself.

The DTD's for XHTML has the link to DTD for XHTML 1 Transitional, where the definition for the script tags are defined:

<!-- these can occur at block or inline level -->
<!ENTITY % misc.inline "ins | del | script">

<!-- these can only occur at block level -->
<!ENTITY % misc "noscript | %misc.inline;">

For a longer diskussion see for example the thread <:noscript> validation with XHTML problem.

An example - usa.gov

As an example let's look at usa.gov which is almost free of validations errors etc., but this &noscript> thingy. A validation of the indexpage with the w3c validator gives Failed validation, 13 Errors. The first error is described as Error Line 1, Column 1985: document type does not allow element "noscript" here; assuming missing "object" start-tag with reference tto this snippet:

…><![CDATA[&nbsp;]]></script><noscript><link href="/styles/main.css" media="sc..

This problem is another variant of this problem. The <noscript> naturally can't go into the head section since markup here (in case the agent doesn't support scripting) would bread the document model. In the annotated DTD this is defined here:

<!--================ Document Head =======================================-->

<!ENTITY % head.misc "(script|style|meta|link|object|isindex)*">

<!-- content model is %head.misc; combined with a single
     title and an optional base element in any order -->

<!ELEMENT head (%head.misc;,
     ((title, %head.misc;, (base, %head.misc;)?) |
      (base, %head.misc;, (title, %head.misc;))))>

notice that <noscript> is not defined whereas <script> is.

Successful Summer Fossil hunting - a 55 million year old shark tooth

Not that it has anything to do with XML - This summer I did a short Fossil hunt with my family on Fur (da: Fossiljagt ved Stendal Høje på Fur). Which took place approximately here.

Hidden or you might say preserved in the diatomite (kieselgur) (da: Moler) are million year old fossils. It was generated about 55 million years ago at the bottom of a big sea, which also covered the area, in which Fur and Mors are situated. The “moler” consists of a mix of fine clay and an inconceivable amount of microscopic diatoms, which lived, died and sank to the bottom of the sea back then.

I was immediately caught by the Jurassic Park feel and got lucky enough to find what was the remaining print of an shark tooth. According to the guy from the museum it should be similar to a Porbeagle. It's not unique but it was the first this year and they normally find around 5 each year though some are smaller.

I left it for the museum since they surely could put it to better use than I. Here's a couple of fotos, first a view of the diatomite block:

And a closeup on the most visible part:

It was my first time as a Paleonthologist and probably not my last try at it. Trying to grasp that I found and held in my hand a print of a life form known today that was more than 50 million years old was truly stunning.

A look at the evolution of the Saitek SST Software for the X52 Pro

In this blogpost I'll have a closer look at the diffenrent versions of SST software for the Saitek X52 Pro - it's a followup on my ealier post Game profile files for the Saitek X52 Pro Flight System. For those who are experiencing problems a just wants to get goint go to the part about the latest driver and SST software

. The main purpose is to get a better idea of what and when.

Release dates

I just bought min recently but when was it released? Dunno for sure but at Amazon it has been available since January 9, 2007:

The pro version is based on the predecessor the X52 (normal) which was available for purcase on Amazon on September 15, 2004:

So the drivers and software has had more the 1½ year to consolidate which shuld be flenty of time. The often mentioned X52 (normal) with which the old format was used is soon 4 years old.

The original software

The driver DVD that came with the controller contains most importantly a driver, SST software and DirectX. It's not exactly new (by date) and for WinXP only, but then again Vista was launching just about that time and I probably got my hands on one from the first shipments. Here's the content overview:

The specific driver is in D:\WinXP\Drivers\0762:

Notice that there's a .pr0 file in the folder. I can reveal that it's the older version in XML, though I'm puzzled why it's there since the SST software only supports the .dat format.

As for the DirectX it's 2 major versions behind - 8.1:

The SST software that came with the DVD

The SST Software on the driver DVD is version 4.3.4.17:

With a nice 3D view mode of the two controllers :

Note: for an even better and static overview see geoffp's layout images in the forum post X52 Pro Profile Graphic Goodness. The SST software also have a tabular overview mode:

And the Saitek DirectOutput for the Multi Functional Display (MFD) is version 5.7.0.24:

Upgrading

Ugrading the drivers can be done through Windows Update or by download, whereas the SST software has to be downloaded manually for upgrad, and is needed to work with the newer drivers. The Sitek public FTP server has the following version available, do note that I don't exactly know the chronologic of them:

ftp://ftp.saitek.com/pub/software/x52pro/

File: sst_191206_32.exe       19677 KB     13:18:00
File: sst_191206_64.exe      19787 KB   13:23:00
File: x52pro_171006_32.exe      3244 KB   11:16:00
File: x52pro_171006_64.exe      3407 KB   11:17:00

ftp://ftp.saitek.com/pub/software/beta. See UKSupport forum post from 27th April 2007, on New Beta Drivers and Software for Windows Vista and XP:

File: Saitek_X52Pro_Flight_Controller_SD6_32_beta2.exe   4068 KB     17:18:00
File: Saitek_X52Pro_Flight_Controller_SD6_64_beta2.exe   4125 KB   17:19:00

Here you'll also get a newer DirectOutput with version 6.0.4.1:

The driver will also be updated but the SST software is not installed. behelith has a workaround by manually running C:\WINDOWS\Temp\Saitek\Saitek_Cyborg_Command_Unit_ SD6_32_Software\00000006\software_loc_9.msi.

ftp://ftp.saitek.com/pub/software/xpvista

File: Saitek_X52Pro_Flight_Controller_SD6_16_32_Drivers.exe   4065 KB     16:08:00
File: Saitek_X52Pro_Flight_Controller_SD6_16_64_Drivers.exe  4124 KB   16:09:00

And finally the versions that you'll get through their driver download wizard at ftp://ftp.saitek.com/pub/software/full/:

File: Saitek_X52Pro_Flight_Controller_SD6_32.exe    4180 KB     10:46:00
File: Saitek_X52Pro_Flight_Controller_SD6_32_Software.exe  17350 KB   10:56:00
File: Saitek_X52Pro_Flight_Controller_SD6_64.exe   4260 KB   10:46:00
File: Saitek_X52Pro_Flight_Controller_SD6_64_Software_.exe  18672 KB   10:57:00

The DirectOutput is now 6.2.2.4 and after manually running the english version (this time in another folder C:\WINDOWS\Temp\Saitek\Saitek_X52Pro_Flight_Controller_SD6_32_Software\00000013\software_loc_9.msi, the software versions are in sync:

SST Software - latest version

SO upgrading to the latest version bumps up two major versions to 6.2.2.4 as can be seen in ex. the Control panel:

And no, the link to The lastest version of the SST Software isn't a direct reference. The software now only has the tabular mode and not the 3D view, which is fine with me since I now have the graphics goodness.

The X52 Pro Flight System driver

Another thing that puzzles me is that with the ealier version you would also get the virtual Magic entries for mouse, keyboard and Hotkey like:

Magic Mouse

Magic Keyboard

Magic Hotkey

But I don't think I'm missing any funtionality, but this is not conclusive since at present I use for very basic purposes.

Roundup

I can't really conclude much except that at present there are drivers and SST software that work with both WinXP and Vista in both 32- and 64 bit. I've personally only used the WinXp 32-bit since I've left my Vista for a while. I is bad that I still had to find the right installer deep down in the Windows\Temp folder, but it could be some unknown specifics with my install.

As for the different profile formats I think that in teory a least it shold be possible to install the beta software, open a dat file, save resulting in also a pr0 file of the XML variant, and the latest you can run through the converter to the real pr0 format.