Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

One of our SSL provider's root certificate expired on 29 Dec 2009. They have a new one that expires in 2029.

Unfortunately, the website that uses the SSL certificate now throws an SSL error, indicating that the certificate cannot be verified because the issuer is unknown.

After some hasty research, we found that in order to get around this problem requires a convoluted process of updating the list of Root CAs on the local machine.

E.g. we'd have to download new CRT files from our SSL provider, then manually import them onto IE, Firefox, etc.

Clearly we cannot inform our everyday site users to update their computers as described above. How does one get over this issue?

Are we supposed to just wait for the browsers to update their list of Root CAs on their next scheduled update?

Although I have managed and installed new SSL certificates before, but I have never come across the situation where we had to update root certificates.

Hope someone can help point me in the right direction.

share|improve this question

3 Answers 3

up vote 2 down vote accepted

The short term solution that will 'fix' the issue would be to simply replace the certificate with one from an alternate vendor. Unfortunately this will mean you are going to have to buy ($$$) new certs.

Here is what the CA vendor suggests. They think you should just wait until browsers get upgraded or manually install certs. This is probably not acceptable for most people.

share|improve this answer
    
Individual SSL certs are fairly cheap. Prices go up for more validation, wildcard certs, etc. But the bottom line is that if you bought from IPS, you lose. –  GregS Jan 11 '10 at 1:21

Unfortunately this appears to be a case of "you get what you pay for". The easiest and least painful solution is probably to replace your current cert with one from another vendor. Thawte (which is owned by Verisign) is the second largest public CA in the world and issues SSL certs for as low as $149.00 US.

share|improve this answer
    
godaddy.com has them for as low as $30 US. –  GregS Jan 11 '10 at 2:28

Your SSL provider updated their root cert but didn't push it out to everyone's browsers with years of time to spare? I'd be finding myself a new CA, right quick, if that's the case. Given that we don't even know which provider you're talking about, specific instructions are impossible to give. I'd triple check that the intermediate certs are installed correctly; as much as I think commercial CAs are snakeoil vendors, I'm yet to hear of one that is quite this incompetent. You should contact your SSL provider and hassle them for how to fix this properly, and get a refund if they actually are that bad.

share|improve this answer
    
For the record, do a search on 'ipsca expiring' to read about the issue. –  Zoredache Jan 11 '10 at 0:50
1  
All I can say is ZOMGWTFBBQ. –  womble Jan 11 '10 at 1:37
    
yes... my sentiments exactly... –  sgstsunshine Jan 11 '10 at 20:25

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.