-1

When visiting an SSL protected website, IE8 complains about the certificate name not matching the website address, but gives no information about the certificate or what name it's looking for.

Visiting the same site in IE9 (or IE9 in "IE8 mode"), Firefox, Chrome, and Safari shows no problems, and that the certificate matches the address. Certificate checkers indicate everything is installed and configured correctly.

Does anyone know what might be causing this? Is this a known issue or bug in IE8? I've been Googling for similar issues, but due to the uncertainty as to what's actually going on, I'm not sure what to search for.

My problem reads similar to this question. However, my server is running Apache2.

Edit: Why the downvotes? Have I not described something adequately? Due to privacy concerns, I can't disclose the website. My server, running Fedora, is definitely configured for SNI. However, based on this article and it's test site, I've confirmed that the browser in question (IE8.0.6001 running Windows XP SP3) explicitly does not send the server name when negotiating SSL connections, so SNI won't help.

5
  • Is this your web server with the problem? If it is, you should know what certificates are installed and you should be able to see the CN and SANs on them to see if there is a mismatch. A link to the website in question would probably be helpful.
    – MDMarra
    Oct 15, 2012 at 19:01
  • 2
    My guess would be the web site requires SNI. What's the web site? Is it trying to serve more than one SSL certificate on the same IP address and port? (Also make sure TLS is enabled in IE.) Oct 15, 2012 at 20:15
  • 1
    If you want us to answer for sure, just post your domain; we can check it fairly simply. If you're worried about people finding your problem via google or whatever, then post it as a comment and then just delete it when you're done. Oct 15, 2012 at 20:43
  • possible duplicate of Multiple SSL domains on the same IP address and same port? Oct 20, 2012 at 23:44
  • Similar to Seeing SSL errors in IE only?
    – TRiG
    Nov 19, 2012 at 11:52

4 Answers 4

5

What vendor is the SSL certificate from? I'm going to assume that it could be from a lesser known vendor that doesn't have a trusted root certificate bundled in IE8, or the machine with IE8 doesn't have the latest root certificate updates.

Honestly though, this is just a guess. You haven't provided near enough information for a definitive answer.


Edit: You say that you've "configured SNI" but you don't mention whether or not this specific site uses SNI. If you are, then no version of IE on Windows XP support SNI. You'll have to use a separate IP for each site and cut out SNI if you want IE on XP to work.

2
  • @Cerin Well that may be the problem, they suck! Either way have you installed all of the proper GoDaddy intermediate certs as well? Oct 18, 2012 at 19:27
  • @Cerin And have you updated the machines in question with the latest Microsoft Root Certificates Update?
    – MDMarra
    Oct 18, 2012 at 19:59
1

You can use these following online tools to check. If you are missing some certificates, intermediate or root, they will inform.

SSL Shopper checker

SSL Server test

1
  • As I mentioned in my post, I've already used these.
    – Cerin
    Oct 15, 2012 at 23:45
1

The problem was caused by IE8's lack of support for SNI. I had two sites configured in Apache, each with its own domain and SSL cert. Due to the lack of SNI, when visiting the second site, Apache could not resolve the name and therefore defaulted to the first site, giving siteB the SSL cert for siteA.

I worked around this by using a load balancer to redirect SSL requests from siteB to a unique port, and then used this port in the Apache site conf to identify siteB SSL requests.

1
  • 2
    Note that the problem is ONLY ON WINXP. IE on other OSes can do SNI just fine.
    – gparent
    Nov 19, 2012 at 15:42
1

With Vista and IE9 (9.0.8112.16421) I had the same problem: Apache 2.2 with SNI and two subdomains. When calling the second domain https://sub2.example.org IE9 always complained because the certificate IE9 had loaded was www.example.org instead of sub2.example.org.

Apache is configured right (no problems with Firefox, Google Chrome or Safari). I enabled and disabled Apache configuration "SSLProtocol all -SSLv2 -SSLv3" but that didnt change anything.

Solution: Go to IE9 Extras Menu, Internet Options/Advanced/Security and disable "Use SSL 2.0". Click Apply.

Edit: Luckily, in the default settings of IE9 SSL 2.0 is disabled.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .