Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

For installation of a certificate I needed to install the root and intermediate certificates as well. This was recognized (after IIS reset) by Firefox and IIS at once, but not by IE, Opera or Network4All. After a physical restart it was recognized by all.

My question is: how can I install the root and intermediate certificates without restarting the entire server? (and, of less importance, come that Firefox recognized this at once, but others didn't)?

share|improve this question
up vote 1 down vote accepted

I think you are seeing Firefox work because firefox most likely already had copies of the root and intermediate installed in its own stores, (which I have mixed feelings about). It seems like browsers are frequently importing intermediate certificates as well as roots into their own keystores now. That's one reason why I use cURL and the CA-provided certificate validation tool to verify the installation whenever I replace a cert.

I've had the problems with IIS you are describing if I installed the cert prior to installing the Intermediate cert but never had issues if the intermediate certs were imported prior to importing the server cert. Unfortunately, depending upon the CA, one does not always realize that the intermediate cert has been replaced until server cert verification is being performed.

share|improve this answer
Perhaps you're right and it would've worked had I installed the root and intermediate certificates first. Not a 100% answer to the question but closest to an explanation for Firefox's behavior and why a restart might've been necessary. – Abel Nov 7 '11 at 8:59

Root certificate installation on Windows should never require a restart. Something else is going on here.

Worst-case, a logoff/logon should have worked - the apps you're describing all look like they're client/user-space apps, and terminating the process and restarting it is likely enough.

share|improve this answer
Well, I would agree with you, if not for the simple fact that it only started working after I issued a full restart. The IIS service itself was restarted before that, but that didn't help. – Abel Nov 7 '11 at 8:57
I'd acquiesce, but we're talking about client behavior versus server behavior: you restarted the service with no effect, then restarted everything, client and server. Anyway, no big deal; IIS doesn't need to be restarted was the key point. – TristanK Nov 7 '11 at 9:46
*always/typically/insert special case here – TristanK Nov 7 '11 at 9:46

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.