Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

When visiting an SSL protected website, IE8 complains about the certificate name not matching the website address, but gives no information about the certificate or what name it's looking for.

Visiting the same site in IE9 (or IE9 in "IE8 mode"), Firefox, Chrome, and Safari shows no problems, and that the certificate matches the address. Certificate checkers indicate everything is installed and configured correctly.

Does anyone know what might be causing this? Is this a known issue or bug in IE8? I've been Googling for similar issues, but due to the uncertainty as to what's actually going on, I'm not sure what to search for.

My problem reads similar to this question. However, my server is running Apache2.

Edit: Why the downvotes? Have I not described something adequately? Due to privacy concerns, I can't disclose the website. My server, running Fedora, is definitely configured for SNI. However, based on this article and it's test site, I've confirmed that the browser in question (IE8.0.6001 running Windows XP SP3) explicitly does not send the server name when negotiating SSL connections, so SNI won't help.

share|improve this question
    
Is this your web server with the problem? If it is, you should know what certificates are installed and you should be able to see the CN and SANs on them to see if there is a mismatch. A link to the website in question would probably be helpful. –  MDMarra Oct 15 '12 at 19:01
2  
My guess would be the web site requires SNI. What's the web site? Is it trying to serve more than one SSL certificate on the same IP address and port? (Also make sure TLS is enabled in IE.) –  David Schwartz Oct 15 '12 at 20:15
1  
If you want us to answer for sure, just post your domain; we can check it fairly simply. If you're worried about people finding your problem via google or whatever, then post it as a comment and then just delete it when you're done. –  Mark Henderson Oct 15 '12 at 20:43
    
possible duplicate of Multiple SSL domains on the same IP address and same port? –  Michael Hampton Oct 20 '12 at 23:44
    
Similar to Seeing SSL errors in IE only? –  TRiG Nov 19 '12 at 11:52

3 Answers 3

What vendor is the SSL certificate from? I'm going to assume that it could be from a lesser known vendor that doesn't have a trusted root certificate bundled in IE8, or the machine with IE8 doesn't have the latest root certificate updates.

Honestly though, this is just a guess. You haven't provided near enough information for a definitive answer.


Edit: You say that you've "configured SNI" but you don't mention whether or not this specific site uses SNI. If you are, then no version of IE on Windows XP support SNI. You'll have to use a separate IP for each site and cut out SNI if you want IE on XP to work.

share|improve this answer
    
@Cerin Well that may be the problem, they suck! Either way have you installed all of the proper GoDaddy intermediate certs as well? –  Brent Pabst Oct 18 '12 at 19:27
    
@Cerin And have you updated the machines in question with the latest Microsoft Root Certificates Update? –  MDMarra Oct 18 '12 at 19:59

You can use these following online tools to check. If you are missing some certificates, intermediate or root, they will inform.

SSL Shopper checker

SSL Server test

share|improve this answer
    
As I mentioned in my post, I've already used these. –  Cerin Oct 15 '12 at 23:45
up vote 0 down vote accepted

The problem was caused by IE8's lack of support for SNI. I had two sites configured in Apache, each with its own domain and SSL cert. Due to the lack of SNI, when visiting the second site, Apache could not resolve the name and therefore defaulted to the first site, giving siteB the SSL cert for siteA.

I worked around this by using a load balancer to redirect SSL requests from siteB to a unique port, and then used this port in the Apache site conf to identify siteB SSL requests.

share|improve this answer
1  
Note that the problem is ONLY ON WINXP. IE on other OSes can do SNI just fine. –  gparent Nov 19 '12 at 15:42

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.