Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I created a certificate for our IIS 6 by sending a request (created with openssl) to our organization's CA. I already had trouble to integrate the private key into that certificate, that has been solved, see SO question

IIS 6.0 now uses the certificate (with TSL v1 and SSL v3), that is the 4th in cert hierarchy. Now, if I access the intranet site, chrome accepts the certificate, so does IE, but Firefox complains about an insecure connection and wants me to add an exceptional rule. If I look into the certificate, how FF presents it to me, I cannot see any of the three issuers.

How can this be? If I connect via openssl s_client -showcerts -connect... I only see my own certificate too, which is said to be not verified. I am quite confused now. Where's the mistake and how can I make FF accept certificate without forcing our users to add that exceptionrule?

Maybe do I have to add all the three issuer certificates into cert store of the win2003 server that hosts IIS 6.0 ??

share|improve this question
So, yes. I just had to add ALL certificates of the authorities, which are in the certificate chain, to trusted root authorities in windows certmgr. That solves the Firefox issue. I cannot post this as answer, since it's my own question. –  FryBurger Jul 20 '12 at 20:53
Great! In fact you can post an answer to your own question, there's just a delay before it's allowed. Try again later! –  Shane Madden Jul 21 '12 at 0:05

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.