title: Configuring Jenkins with StartSSL - adding the issuer chain
body: <p>I am unable to correctly configure Jenkins to use a StartSSL certificate.
  I'm running it with command line arguments that specify paths to the private key and my certificate as shown on the Jenkins Wiki (at the bottom: <a href="https://wiki.jenkins-ci.org/display/JENKINS/Starting+and+Accessing+Jenkins" rel="noreferrer">https://wiki.jenkins-ci.org/display/JENKINS/Starting+and+Accessing+Jenkins</a>).</p>
  
  <ul>
  <li>I've obtained a private key and a certificate from StartSSL</li>
  <li>I've placed them in a particular folder</li>
  <li>I'm running Jenkins as follows: <code>java -jar jenkins.war --httpPort=-1 --httpsPort=8080 --httpsCertificate=&lt;mydomain.crt file&gt; --httpsPrivateKey=&lt;my private key file&gt;</code></li>
  </ul>
  
  <p>Jenkins starts successfully. Opening <code>https://mydomain:8080/</code> in Firefox says that the connection is untrusted:</p>
  
  <pre><code>mydomain:8080 uses an invalid security certificate.
  The certificate is not trusted because no issuer chain was provided.
  (Error code: sec_error_unknown_issuer)
  </code></pre>
  
  <p>I've tried verifying <code>mydomain:8080</code> on various SSL checker websites:</p>
  
  <pre><code>OK mydomain resolves to xxx.xxx.xxx.xxx
  
  OK The certificate was issued by StartCom.  
  
  OK The certificate will expire in XXX days. 
  
  OK The hostname (mydomain) is correctly listed in the certificate.
  
  Not OK The certificate is not trusted in all web browsers.
         You may need to install an Intermediate/chain certificate
         to link it to a trusted root certificate.
  </code></pre>
  
  <p>StartSSL does not have explicit instructions for setting up Jenkins. I've tried following up on similar tutorials for other kinds of servers, and copied the intermediate authority files from StartCom into a unified certificate (<code>ca.pem</code> and <code>sub.class1.server.ca.pem</code> as noted here: <a href="http://www.startssl.com/?app=42" rel="noreferrer">http://www.startssl.com/?app=42</a>).</p>
  
  <p>However, this did not change anything.</p>
  
  <p>SSL checkers like www.sslshopper.com/ssl-checker.html‎ still report that the website is untrusted.
  Also, the GitHub image caching service is not rendering the build status icon from Jenkins for the same reason.</p>
  
  <p>How do I add the issuer chain correctly to my certificate?</p>