1

I asked this question on stackoverflow, and I've been suggested to repost it here.

I have a problem accessing my site (on https) with IEMobile 9 (WP 7.5).

It says it's got problem with the certificate, as if it wasn't valid. Everything works on any other browser or platform I tested (android (several phones and a galaxy tab with stock browser, firefox, opera, dolphin), iOS (iphone and ipad with safari and chrome), an old nokia with symbian, windows 7, linux and mac).

To try to solve this I saved the certificate (.cer) on the server and accessed it from the phone browser. It always complained except when I accessed it through the server IP (192.168.xx.xx). At that point it (said it) installed correctly the certificate. If then I try to access the index.html still using the IP all works fine and it doesn't complain about the certificate. If, though, I try to access the index using the actual URL (blah.myblah.com), it complains again about the certificate, as if it wasn't installed!

It isn't a problem of DNS, cause that's up and serving the right ip, and the phone is correctly setup to use it.

The certificate is signed by geotrust/rapidssl for *.myblah.com.


Edit: added info

:~$ openssl s_client -connect blah.myblah.com:443
CONNECTED(00000003)
depth=0 /serialNumber=az2FuQJsYguGU37CPKkH8XRt2J6HBYYr/OU=GT51835720/OU=See www.rapidssl.com/resources/cps (c)12/OU=Domain Control Validated - RapidSSL(R)/CN=*.myblah.com
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 /serialNumber=az2FuQJsYguGU37CPKkH8XRt2J6HBYYr/OU=GT51835720/OU=See www.rapidssl.com/resources/cps (c)12/OU=Domain Control Validated - RapidSSL(R)/CN=*.myblah.com
verify error:num=27:certificate not trusted
verify return:1
depth=0 /serialNumber=az2FuQJsYguGU37CPKkH8XRt2J6HBYYr/OU=GT51835720/OU=See www.rapidssl.com/resources/cps (c)12/OU=Domain Control Validated - RapidSSL(R)/CN=*.myblah.com
verify error:num=21:unable to verify the first certificate
verify return:1
---
Certificate chain
 0 s:/serialNumber=az2FuQJsYguGU37CPKkH8XRt2J6HBYYr/OU=GT51835720/OU=See www.rapidssl.com/resources/cps (c)12/OU=Domain Control Validated - RapidSSL(R)/CN=*.myblah.com
   i:/C=US/O=GeoTrust, Inc./CN=RapidSSL CA
---
Server certificate
-----BEGIN CERTIFICATE-----
<certificate>
-----END CERTIFICATE-----
subject=/serialNumber=az2FuQJsYguGU37CPKkH8XRt2J6HBYYr/OU=GT51835720/OU=See www.rapidssl.com/resources/cps (c)12/OU=Domain Control Validated - RapidSSL(R)/CN=*.myblah.com
issuer=/C=US/O=GeoTrust, Inc./CN=RapidSSL CA
---
No client certificate CA names sent
---
SSL handshake has read 1897 bytes and written 319 bytes
---
New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-SHA
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1
    Cipher    : DHE-RSA-AES256-SHA
    Session-ID: <session-ID>
    Session-ID-ctx:
    Master-Key: <Master-Key>
    Key-Arg   : None
    Start Time: 1354176967
    Timeout   : 300 (sec)
    Verify return code: 21 (unable to verify the first certificate)
---
7
  • Is this public-facing? Could you give any more detail about the SSL certificate and the site? It sounds like there's a mismatch in the name at some level.
    – Nathan V
    Nov 29, 2012 at 4:03
  • Could you try openssl s_client -showcerts -connect blah.myblah.com:443 and post the results?
    – Nathan V
    Nov 29, 2012 at 4:10
  • i'll update the question with that info
    – user147380
    Nov 29, 2012 at 9:57
  • Did you try this with a device that hadn't accessed the page before? Your browser/os might just be doing some caching, Nov 30, 2012 at 9:13
  • I did try with a device and with the Windows Phone emulator. Same result. What concerns me most is that once I installed the certificate I get no error accessing the IP and I get them using the URL.
    – user147380
    Nov 30, 2012 at 9:29

1 Answer 1

0

As far as I know about these RapidSSL certificates, they need their "chain certificate" to be installed too, else it won't work. Did you install that too?

2
  • sorry for the delay, i was on vacation :) i didn't, i'll try that and see if it works.
    – user147380
    Jan 7, 2013 at 8:57
  • ok, talking to my sysad he says the chain certificate and all is inside it, so it should be installed altogether.
    – user147380
    Jan 8, 2013 at 10:51

You must log in to answer this question.