0

I've had an SSL certificate installed for my Tomcat web application for the past year, running just fine. As the certificate is expiring, I needed to replace it. I went through the usual channels, generated a new CRT, and got a replacement certificate from GoDaddy (the certificate provider).

I then created a new keystore using my certificate and the root, cross, and intermediate certs provided by GoDaddy. I noted that when the keystore was complete, 3 of the 4 entries were identical to the existing, working keystore on the live site (although the listing order of the cross and intermed certs were reversed; does that matter?). The one entry that was different was my own, new certificate--which makes sense. This was all very encouraging.

Nonetheless, when I installed the new keystore on my webapp's site, I got an Untrusted Certificate Warning from the browser when I tried to access my site. When I called GoDaddy tech support about this, the rep said that it's because I have two outstanding certificates on the same site and that the warning will go away when the old one expires next week. I am highly dubious of this theory, and if it's incorrect, then I will be left the morning of without a properly functioning cert and no ideas on how to fix it.

What could be the real reason behind the Untrusted Cert warning?

Improve this question
0

1 Answer 1

Reset to default
0

The problem ended up being that I when I entered the domain name for the Distinguished Name information while generating the key, I used an asterisk, e.g.: *.myserver.com, thinking this would cover me for myserver.com, www.myserver.com, etc. However, the asterisk is only appropriate for "wildcard" certificates, which I apparently don't have.

So I regenerated the key using just "myserver.com", and it worked just fine. And for some reason it still works for both "myserver.com" and "www.myserver.com".

Incidentally, this site was very helpful to me in diagnosing this problem:

http://www.sslshopper.com/ssl-checker.html

Improve this answer
1
  • The reason it works is that most likely you have Subject Alternate Name extension on the certificate that lists both myserver.com and www.myserver.com. A lot of CAs do this when issuing certificates.
    – Nasko
    Jul 23, 2010 at 16:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .