0

We are having one user who is having an issue connecting to one of our servers.

we have a wildcard cerificate : *.ourdomain.com

user can go to d.ourdomain.com and have no certificate error in the browser. but if they go to i.ourdomain.com (which is a specific server) they get a certificate error saying the root CA is not valid. But its the same certificate as the other address, and the issuer shown in the error is listed in thier system as a trusted CA?

Any ideas on what to look at or what more information I can try providing here to help solve this?

this is LOW priority as its only one user having this issue, but still want to solve it for this user to make all our users happy.

Improve this question

4 Answers 4

Reset to default
1

Maybe the user has an old version of the certificate cached and isn't seeing the current copy?

For example in IE6/7 they could

  1. On the Tools menu in Internet Explorer, click Internet Options, and then click the Security tab.
  2. Click the Content tab.
  3. In the Certificates section, click Clear SSL State, and then click OK.
  4. Open the Certificates area and remove any certificate related to i.ourdomain.com

Then try accessing the site again.

If they confirm they are in IE6 ask them to upgrade to IE7 assuming you don't have legacy code issues that require IE 6 only. If you do force the use of IE6 just send them to http://support.microsoft.com/kb/870700 and have them do it all if the short version above doesn't work.

If IE is a problem you could also suggest they download Firefox and see how it behaves there.

Improve this answer
1
  • Thanks, we will try that and see what results we get. will post results after we hear them.
    – MikeScott8
    Nov 2, 2009 at 21:34
0

Does the offending server have the root cert that was used to sign your wildcard cert installed it? Or any intermediate certificates between that and your wildcard? I've broken a website that way before.

Try exporting all the certificates in the chain from one of the servers that's behaving properly, and importing them into the appropriate certificate stores on the server that isn't.

Improve this answer
1
  • will check that, but I would think if that was case every user hitting that server would get the error.
    – MikeScott8
    Nov 2, 2009 at 21:54
0

Here's a theory: the user that's having the problem is using a browser that doesn't have the signing chain for your cert's CA, and the server for i.ourdomain.com isn't presenting the intermediate certificate. So fixing either the user or the server would solve the problem.

Improve this answer
1
  • thanks that could explain why just the one user is having the problem. will check into that on the server
    – MikeScott8
    Nov 11, 2009 at 15:29
0

You most likely don't have the necessary chain certificates on that particular server. You can verify that here: http://www.sslshopper.com/ssl-checker.html

You'll just need to install the Intermediate/chain certificates that came with your main certificate from the SSL provider to get rid of the error.

Improve this answer

You must log in to answer this question.