Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a client certificate from startssl. I can login to their control panel with that certificate and Firefox.

But with my website I am NOT prompted for the certificate only when using IE or Chrome not Firefox.

I did second test on another pc so I looked at FF certificate authority. I can see that intermediate ca are missing. Why FF doesn't download them automatically ? Is there something to configure on IIS for that ?

Update: I found this about certificates chain. Can IIS force to send back whole chain ?

How did startssl did because they automatically install my client certificate ?

share|improve this question
why -1 :( as usual guy who can't answer a question just flags it. This is a legitimate question I'm not alone – user46250 Aug 20 '12 at 2:30
The wonderfull world of admin who forgot they have been newbies themselves huh ? Do you feel superior because someone is learning something new ? OK good if I can contribute to your ego ! – user46250 Aug 20 '12 at 2:33
Getting self-rigorous on a total stranger is possibly the worst way to get people to help you. You're asking for free help, critics come with the territory. We have not forgotten what it was like to be a newbie, humility was a large part of the experience. – Chris S Aug 20 '12 at 2:41
up vote 1 down vote accepted

You can set firefox to prompt you every time a client certificate is requested in the encryption panel in preferences. This should aid in troubleshooting.

It isn't necessary for a browser to download intermediate certificates, because any server that has a certificate issued will normally send the entire chain, starting with the server certificate and ending in the CA. The browser validates this chain to the CA certificate, and then checks whether that certificate is a trusted CA. The intermediate certificate need not be explicitly trusted (or stored), because it is signed by a trusted CA.

You may need to set IIS to require, instead of just accept, a client certificate, if you didn't already.

share|improve this answer
ok thanks for help :) – user46250 Aug 20 '12 at 3:39

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.