Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I asked this question on stackoverflow, and I've been suggested to repost it here.

I have a problem accessing my site (on https) with IEMobile 9 (WP 7.5).

It says it's got problem with the certificate, as if it wasn't valid. Everything works on any other browser or platform I tested (android (several phones and a galaxy tab with stock browser, firefox, opera, dolphin), iOS (iphone and ipad with safari and chrome), an old nokia with symbian, windows 7, linux and mac).

To try to solve this I saved the certificate (.cer) on the server and accessed it from the phone browser. It always complained except when I accessed it through the server IP (192.168.xx.xx). At that point it (said it) installed correctly the certificate. If then I try to access the index.html still using the IP all works fine and it doesn't complain about the certificate. If, though, I try to access the index using the actual URL (blah.myblah.com), it complains again about the certificate, as if it wasn't installed!

It isn't a problem of DNS, cause that's up and serving the right ip, and the phone is correctly setup to use it.

The certificate is signed by geotrust/rapidssl for *.myblah.com.


Edit: added info

:~$ openssl s_client -connect blah.myblah.com:443
CONNECTED(00000003)
depth=0 /serialNumber=az2FuQJsYguGU37CPKkH8XRt2J6HBYYr/OU=GT51835720/OU=See www.rapidssl.com/resources/cps (c)12/OU=Domain Control Validated - RapidSSL(R)/CN=*.myblah.com
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 /serialNumber=az2FuQJsYguGU37CPKkH8XRt2J6HBYYr/OU=GT51835720/OU=See www.rapidssl.com/resources/cps (c)12/OU=Domain Control Validated - RapidSSL(R)/CN=*.myblah.com
verify error:num=27:certificate not trusted
verify return:1
depth=0 /serialNumber=az2FuQJsYguGU37CPKkH8XRt2J6HBYYr/OU=GT51835720/OU=See www.rapidssl.com/resources/cps (c)12/OU=Domain Control Validated - RapidSSL(R)/CN=*.myblah.com
verify error:num=21:unable to verify the first certificate
verify return:1
---
Certificate chain
 0 s:/serialNumber=az2FuQJsYguGU37CPKkH8XRt2J6HBYYr/OU=GT51835720/OU=See www.rapidssl.com/resources/cps (c)12/OU=Domain Control Validated - RapidSSL(R)/CN=*.myblah.com
   i:/C=US/O=GeoTrust, Inc./CN=RapidSSL CA
---
Server certificate
-----BEGIN CERTIFICATE-----
<certificate>
-----END CERTIFICATE-----
subject=/serialNumber=az2FuQJsYguGU37CPKkH8XRt2J6HBYYr/OU=GT51835720/OU=See www.rapidssl.com/resources/cps (c)12/OU=Domain Control Validated - RapidSSL(R)/CN=*.myblah.com
issuer=/C=US/O=GeoTrust, Inc./CN=RapidSSL CA
---
No client certificate CA names sent
---
SSL handshake has read 1897 bytes and written 319 bytes
---
New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-SHA
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1
    Cipher    : DHE-RSA-AES256-SHA
    Session-ID: <session-ID>
    Session-ID-ctx:
    Master-Key: <Master-Key>
    Key-Arg   : None
    Start Time: 1354176967
    Timeout   : 300 (sec)
    Verify return code: 21 (unable to verify the first certificate)
---
share|improve this question
    
Is this public-facing? Could you give any more detail about the SSL certificate and the site? It sounds like there's a mismatch in the name at some level. –  Nathan V Nov 29 '12 at 4:03
    
Could you try openssl s_client -showcerts -connect blah.myblah.com:443 and post the results? –  Nathan V Nov 29 '12 at 4:10
    
i'll update the question with that info –  Stephan Nov 29 '12 at 9:57
    
Did you try this with a device that hadn't accessed the page before? Your browser/os might just be doing some caching, –  Jens Timmerman Nov 30 '12 at 9:13
    
I did try with a device and with the Windows Phone emulator. Same result. What concerns me most is that once I installed the certificate I get no error accessing the IP and I get them using the URL. –  Stephan Nov 30 '12 at 9:29

1 Answer 1

As far as I know about these RapidSSL certificates, they need their "chain certificate" to be installed too, else it won't work. Did you install that too?

share|improve this answer
    
sorry for the delay, i was on vacation :) i didn't, i'll try that and see if it works. –  Stephan Jan 7 '13 at 8:57
    
ok, talking to my sysad he says the chain certificate and all is inside it, so it should be installed altogether. –  Stephan Jan 8 '13 at 10:51

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.