For our corporate network we use an internal CA, which directly signs some intranet server certificates. Now the root certificate is about to expire. I tried to renew it with the following OpenSSL command:
openssl req -new -x509 -days 123 -key root.key -out root.crt
I deleted the old certificate from my PC and installed the new one. Windows/IE, Chrome, and Opera seem to be fine with it, but Firefox won't accept it. Trying to access an intranet server gives me the sec_error_unknown_issuer
error, stating that no chain is provided. I googled my fingers to the bone, but the only answer I could find was that that the intermediate certificate is missing from the server config. But in my case there is no intermediate CA!! Why can't Firefox link the server certificate to the new root? All the other browsers seem to be able to and even openssl verify
says everything is OK. Any ideas?