One of our SSL provider's root certificate expired on 29 Dec 2009. They have a new one that expires in 2029.
Unfortunately, the website that uses the SSL certificate now throws an SSL error, indicating that the certificate cannot be verified because the issuer is unknown.
After some hasty research, we found that in order to get around this problem requires a convoluted process of updating the list of Root CAs on the local machine.
E.g. we'd have to download new CRT files from our SSL provider, then manually import them onto IE, Firefox, etc.
Clearly we cannot inform our everyday site users to update their computers as described above. How does one get over this issue?
Are we supposed to just wait for the browsers to update their list of Root CAs on their next scheduled update?
Although I have managed and installed new SSL certificates before, but I have never come across the situation where we had to update root certificates.
Hope someone can help point me in the right direction.