3

We received new computers for use in the office (Dell Vostro). They seem to work fine for the most part but when we use IE8 to go to some websites, such as Yahoo! Mail, it tells us:

There is a problem with this websites security certificate

If we have a look at the details it says:

This certificate cannot be verified up to a trusted certification authority

The same websites, however, work correctly in Firefox. I don't understand why the error message appears. Should this not just work?

I don't think it's anything to do with the certificate itself as this is happening on www.yahoo.co.uk and other commercial (Amazon I think?) sites. I think there is something off with the PCs' setup.

The PC has Windows 7 (64 bit) and Norton Internet Security installed.

Any ideas as to why this is happening?

3 Answers 3

2

It sounds like you probably don't have some Microsoft Root Certificate Updates installed. If you have WSUS at your workplace, it's possible that the administrator hasn't approved these updates for some reason, causing this issue. Comodo, Digicert and a few others have had new root CAs put in place over the last year and a half for various reasons. If you don't have these updates, this issue will occur. Just because your machine is telling you that you don't have any updates doesn't mean there aren't a bunch on a WSUS server somewhere waiting to be approved.

0

This is happening because Internet Explorer and FireFox have a different set of Trusted CA's and something has happened to Internet Explorer's list of Trusted CAs.

These can be modified by an Active Directory GPO I believe.

I just had a look at https://login.yahoo.com and they're secured by Equifax. Interestingly they're using a cheapo domain-validated certificate (not that this is particularly relevant), but I would check to see if the Equifax CA is installed on your machines.

2
  • No I don't think they have the Equifax certificate installed (or others such as Comodo). I thought that if the browser hit a site such as yahoo.co.uk and it didn't have the certificate installed it got the relevant information - (root certificate?) from somewhere? As this is Windows and IE I thought the browser would ask MS if the certificate was ok - or get a list of valid certs in Windows update?
    – Steve
    Dec 21, 2009 at 22:26
  • 1
    IE8 treats certificates a bit differently to previous versions. If a certificate is on a OSCP or CRL list it will flat out deny access with no choice. Also, it doesn't 'grab' any root certs, otherwise anyone could just get any certificate validated by their own root and it would be accepted. It is a bit odd that it's not allowing acceptance of the certificate, but this can also be overriden in the IE settings Dec 21, 2009 at 22:31
0

Check windows update to make sure there isn't a lingering (and optional) Root Certificate Update that you need to install.

2
  • I don't think their were any updates available, will check when back at work.
    – Steve
    Dec 30, 2009 at 13:47
  • I've checked, no updates are available..
    – Steve
    Jan 6, 2010 at 19:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .