Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm running Windows Server 2008 R2 with IIS 7.5. This is in a development environment.

I have a self-signed certificate, and a second wildcard server authentication certificate which was issued by the first. Both have been imported into my Trusted Root Certification Authorities. The wildcard certificate is used in bindings for several sites that exist in the same domain.

When I access one of these sites from my machine, on which the root self-signed certificate has also been added, everything works perfectly.

When I access one of these sites from another machine, on which the root cert hasn't been trusted, I get the expected warning from my browser. I can choose to trust the certificate and access the page and, aside from the warning, everything works perfectly.

However, when I access one of these sites from the server itself, I get a variety of errors, depending on browser. Chrome refuses to load the site at all, claiming that the SSL certificate it has been issued is invalid. Firefox reports an (Error code: sec_error_unknown_issuer) because no issuer chain was provided, but will let me access the site if I override the error. Internet Explorer refuses to load the site and also doesn't give an error message.

Why does the certificate scheme fail when accessing the site from the server?

NB: I am a developer by trade and not a network admin, so I am very open to including additional information which may be helpful in answering the question. I'm not sure what I need to know!

share|improve this question
The sec_error_unknown_issuer occurs, since you probably have not installed the certificate to the firefox - which does not use the trusted root store. I would guess, maybe the browser accesses the website via "localhost" and thus gets a name mismatch for the certificate? –  cornelinux Aug 6 '14 at 19:15
@cornelinux Thank you for your comment. Since the error occurs in more browsers than just Firefox, and is not the typical URL-does-not-match-certificate-name error, I am inclined to think that is not the issue. –  NWard Aug 6 '14 at 19:48
Do you can observe a different behaviour, if you are accessing the server via localhost, ip-address or fqdn? ... just to narrow it down. –  cornelinux Aug 7 '14 at 17:26

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.