Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have an SSL certificate (from Verisign) installed on a web service. If I access this from my own machine (and a number of client machines in the office), it is verified, trusted and happy. If I access it from one server, it is trusted but from another one it is not.

Obviously, the one that doesn't trust it is one that needs to communicate with that web service.

What's gone wrong here? I don't know too much about SSL (the certificates were installed by another team), so I don't totally get what the Verisign site is saying about installation, or if I should even be looking at it.

EDIT: I've installed a Verisign root certificate on the server now, since this was not there before. It's showing the web service as trusted from IE on the server, but the application (hosted in IIS) that is supposed to talk to the web service still cannot communicate. We have scheduled in an IIS restart later today, to see if that resolves it. Any other advice is appreciated!

share|improve this question
    
Browser will tell you what is wrong. Also this excelent online tool will test your SSL and reveal possible problem: ssllabs.com –  mkudlacek Mar 8 '11 at 9:52
    
That tool couldn't recognise my domain name - could that be because it's a) an internal web service only or b) a certificate on a sub-domain? Also, see edit: Browser now doesn't report a problem, but application calling web service still throws error. –  pete the pagan-gerbil Mar 8 '11 at 10:43
    
@John Gardeniers: This was the exact solution. The certificate I installed fixed it in IE, but not other apps, but copying it from another machine worked perfectly. If you'd put this as an answer rather than a comment I'd accept it! –  pete the pagan-gerbil Mar 8 '11 at 10:53

2 Answers 2

up vote 1 down vote accepted

Check to see if the correct root certificate is on the affected server. Copy it from another machine if necessary.

share|improve this answer

There are two reasons I can think of that a client would not recognize a valid certificate: one is that the client is using an old browser or outdated root certificates. Second, the certificate requires a SSLCertificateChainFile to validate against an intermediate certificate. A lot of the SSL vendors are using Intermediate certificates it seems, rather than signing issued certs directly with their root certs. If the team that installed the cert did not install the intermediate cert, this could cause the problem. I saw this recently with a RapidSSL cert where the intermediate certificate was required for Android devices, but Firefox/Safari/IE all worked fine.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.