Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have a website that has an SSL Certificate from GoDaddy. Our Japanese Office is reporting that some of their clients cannot access the secure site via their mobile phone. Apparently one of the major carriers does not have root certs for GoDaddy.
Other than picking a cert from another vendor, what are our options?

Update: The reason we cannot easily change the cert vendor is the site is hosted by our software vendor, so I'm sort of at their mercy.

share|improve this question

4 Answers 4

up vote 2 down vote accepted

You're pretty much up the creek without a paddle. Verisign used to be the safest vendor to use. These days Thawte is safe as well.

Here's one of the few handset specifications in English here: http://communaute.imode.fr/pages/13/i-mode_Handset_specification_N343i.pdf

Its a 2005 model - but shows in the specs the SSL providers supported. The newer models do support more providers, but better to be safe than sorry.

The only other way would be allow the site over http and for the http version restrict it to the ip range for mobiles from Docomo, AU, Softbank, Willcom and E-Mobile. Somewhat of a security hole and not something I'd recommend - but I guess an option depending on the content. For the IP ranges - you'll probably have to get your Japanese office to do some googling or contact the companies. I know they used to be available.

share|improve this answer
    
Can't turn off https, it's an e-commerce site handling credit cards. –  BillN Jul 23 '09 at 3:40

Typically if the SSL vendor signs your certificate with an intermediate cert, they provide you the intermediate cert to install on your server as the CA cert. The intermediate cert should then be signed by the cert that is installed in the browser. Did you not install the intermediate certificate?

share|improve this answer
    
We did install the intermediate, but some phones' webbrowser don't have a root cert for GoDaddy to trust the intermediate, so they don't trust ours. The user can click OK to click through, but the phones won't install the cert permanently. –  BillN Jul 23 '09 at 3:38
1  
Unless you change the cert, the "click OK to click through" method is going to be your only option. You said you could not "easily" change the cert vendor? Depending on how big of a problem this is, that's going to be your solution. –  churnd Jul 23 '09 at 12:00

Each phone has some sort of webbrowser and that browser has a certificate store but usually there is no way to import certs permanently into those browsers. I'd guess that you probably need to figure out how to host the proper cert on your site so that the cell phone can download and TEMPORARILY install the cert chain (for the current session) before it starts the web transaction with your site.

Please dont mark me down for this. Im just trying to help.

share|improve this answer

I've used both RapidSSL and InstantSSL in the past. Depending on what cert you're looking for the prices are different so I recommend shopping the two sites for the best price.

I also recommend calling them up and seeing if you can get an even cheaper price (I've done it but can't remember which one) although you typically need to go multiple years or wildcard cert. Nobody wants to give a discount on a dirt cheap single cert. :-)

RapidSSL

http://www.rapidssl.com

InstantSSL

http://www.instantssl.com

share|improve this answer
1  
The question did ask "other than picking a cert from another vendor". Anyway, the cheapest RapidSSL (which have no intermediate CA) certs can be had from namecheap.com - $9.95/year for 2 or 3 years. –  TRS-80 Jul 23 '09 at 3:04
    
Wow... rough day for me. I completely misread that last line. My mind went straight to new provider with a better (root) certificate. My bad. –  KPWINC Jul 23 '09 at 3:36

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.