Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Update: Issue solved by re-rolling the certificate.

I have a Windows 2008 R2 Server that runs a HTTPS Tunneling service. The software uses a certificate that is provided via the Windows certificate store. The certificate is located in the local computer private certificates. It supports server and client authentication with signing and keyencipherment.

Cert chain

The certificate chain looks fine. It's a Thawte SSL123 certificate.

  • Thawte Premium Server CA (SHA1) [‎e0 ab 05 94 20 72 54 93 05 60 62 02 36 70 f7 cd 2e fc 66 66]
    • thawte Primary Root CA [‎1f a4 90 d1 d4 95 79 42 cd 23 54 5f 6e 82 3d 00 00 79 6e a2]
      • Thawte DV SSL CA [3c a9 58 f3 e7 d6 83 7e 1c 1a cf 8b 0f 6a 2e 6d 48 7d 67 62]
        • Server certificate


Most browsers accept the certificate without any warning. But IE 7 on Windows XP SP3 and Opera 12 on OSX just report an connection error. Opera complains:

Secure connection: fatal error (552)
Opera was not able to connect to the server, because the server does not communicate via any secure protocol known to Opera.

A connection test using openssl s_client -connect -state says:

SSL_connect:before/connect initialization
SSL_connect:SSLv2/v3 write client hello A
52471:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:/SourceCache/OpenSSL098/OpenSSL098-35.1/src/ssl/s23_lib.c:182:

ssldump -aAHd host during curl reports:

New TCP connection #1: localhost(53302) <->
1 1  0.0235 (0.0235)  C>SV3.1(117)  Handshake
        Version 3.1 
          50 77 56 29 e8 23 82 3b 7f e0 ae 2d c1 31 cb ac 
          38 01 31 85 4f 91 39 c1 04 32 a6 68 25 cd a0 c1 
        cipher suites
        Unknown value 0x39
        Unknown value 0x38
        Unknown value 0x35
        Unknown value 0x33
        Unknown value 0x32
        Unknown value 0x2f
        Unknown value 0x9a
        Unknown value 0x99
        Unknown value 0x96
        Unknown value 0xff
        compression methods
                unknown value
1    0.0479 (0.0243)  S>C  TCP FIN
1    0.0481 (0.0002)  C>S  TCP FIN

Thawte provides two Java based SSL Checkers. The Legacy Thawte SSL Certificate Installation Checker and the sslToolBox. Both validate the certificate under Windows XP but report connection errors under OSX and Windows 2008 R2.

share|improve this question
There is a similar question by victor-hugo: – Roman Oct 11 '12 at 23:43

1 Answer 1

up vote 0 down vote accepted

I did not find out what the issue was, but solved it via re-enrolling a new certificate. This Time using the IIS Manager instead of doing it manually using the Windows Certificate Manager.

So my only tip would be to start from scratch if things are too strange and searching for an error takes more time than just starting over.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.