Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have IIS7 on windows 2008 and we installed verisign certificate and bound it to https. Certificate seems fine.

Chain: - not expired
VeriSign international server CA class 3 - not expired
Verisign Class 3 Public primary certification Authority - not expired

Yet when I use verisign online validation, I get that second certificate is expired.

This is what it reports, mysite is reported to be ok:

--Issued To-- 
Organization: VeriSign Trust Network 
Organizational Unit: Ref. LIABILITY LTD.(c)97 VeriSign 
Organizational Unit 2: VeriSign International Server CA - Class 3 
Organizational Unit 3: VeriSign,, Inc.  
--Issued By-- 
Organization: VeriSign,, Inc. 
Organizational Unit: Class 3 Public Primary Certification Authority 
Country: US  
Validity Start: Wed Apr 16 17:00:00 PDT 1997
Validity End: Wed Jan 07 15:59:59 PST 2004

Any ideas?

share|improve this question
up vote 1 down vote accepted

Did you use the right intermediate and is it chained properly? VeriSign certificates are extremely picky.

I'd suggest trying the following:

1) Use VeriSign's site to lookup the common name for the cert:

2) Cross-reference the name in the search with the required intermediate here:

3) Examine the certificate bundle you received and ensure that the certs match up. You can use OpenSSL, keytool, Windows etc... whatever tools you have available.

4) Ensure that the root certificate exists on the server Windows will usually already have them updated.



share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.