Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

have a wildcard ssl cert issued to: *.domain.com

The cert. is used on 4 virtual hosts in apache2:

mail.domain.com

gis.domain.com

data.domain.com

timecard.domain.com

Firfox works great, no errors. 50% of the time IE works, but on more secured computers, DoD network, an error is thrown:

"There is a problem with this website's security certificate. The security certificate presented by this website was not issued by a trusted certificate authority."

Would a Multi-domain cert. be better since you could specify 4 SAN's rather then *.domain.com?

here is 1 of the apach2 virtual hosts

ServerName data.domain.com
SSLEngine on
SSLCertificateFile /usr/local/apache/cert/domain.com.crt
SSLCertificateKeyFile /usr/local/apache/private.key
SSLCertificateChainFile /usr/local/apache/data.domain.com.cabundle

Thanks!

share|improve this question
    
Have the offending computers applied their Root Certificates Update from Microsoft? –  Michael Hampton Apr 3 '13 at 21:09
    
i have no way of knowing this due to security restrictions. I did have an offending computer try a different public site, not on our server, that was secured with a COMODO cert. (our wildcard cert. provider) and it worked w/out any errors. –  dan Apr 3 '13 at 21:16
    
If you can't reproduce the problem, and/or can't determine the cause, then you can't really solve it. The root certificates would be the first thing I would look at. Not updating those will cause security problems, since CAs do sometimes get revoked. –  Michael Hampton Apr 3 '13 at 21:18
    
@dan Do all of the virtual hosts on that port have the exact same SSLCertificateFile line? –  Shane Madden Apr 4 '13 at 5:37
    
3 of the 4 virtual hosts reference the same SSLCertificateFile. timecard.domain.com references a dif. path for SSLCertificateFile, but the contents of the cert. are exactly the same. I should change this so they are all the same, but never have. –  dan Apr 5 '13 at 14:46

1 Answer 1

Certificate issuers often have more than one root certificate.

The error indicates that your certificate was issued by a root that isn't trusted by the computers giving the error. This fits perfectly well with the fact that it works on some clients and others complain about it. It has nothing to do with it being a wildcard certificate.

Most likely this is not your problem; if the person in control of the client workstations doesn't update the trust root, or removed the certificate in your trust root, or has explicitly distrusted a certificate in your chain, you will get trust errors. That is their problem to fix. However, you could potentially request a new certificate issued from a different root, and hope that acceptance of it is more universal.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.