Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We received new computers for use in the office (Dell Vostro). They seem to work fine for the most part but when we use IE8 to go to some websites, such as Yahoo! Mail, it tells us:

There is a problem with this websites security certificate

If we have a look at the details it says:

This certificate cannot be verified up to a trusted certification authority

The same websites, however, work correctly in Firefox. I don't understand why the error message appears. Should this not just work?

I don't think it's anything to do with the certificate itself as this is happening on and other commercial (Amazon I think?) sites. I think there is something off with the PCs' setup.

The PC has Windows 7 (64 bit) and Norton Internet Security installed.

Any ideas as to why this is happening?

share|improve this question

It sounds like you probably don't have some Microsoft Root Certificate Updates installed. If you have WSUS at your workplace, it's possible that the administrator hasn't approved these updates for some reason, causing this issue. Comodo, Digicert and a few others have had new root CAs put in place over the last year and a half for various reasons. If you don't have these updates, this issue will occur. Just because your machine is telling you that you don't have any updates doesn't mean there aren't a bunch on a WSUS server somewhere waiting to be approved.

share|improve this answer

This is happening because Internet Explorer and FireFox have a different set of Trusted CA's and something has happened to Internet Explorer's list of Trusted CAs.

These can be modified by an Active Directory GPO I believe.

I just had a look at and they're secured by Equifax. Interestingly they're using a cheapo domain-validated certificate (not that this is particularly relevant), but I would check to see if the Equifax CA is installed on your machines.

share|improve this answer
No I don't think they have the Equifax certificate installed (or others such as Comodo). I thought that if the browser hit a site such as and it didn't have the certificate installed it got the relevant information - (root certificate?) from somewhere? As this is Windows and IE I thought the browser would ask MS if the certificate was ok - or get a list of valid certs in Windows update? – Steve Dec 21 '09 at 22:26
IE8 treats certificates a bit differently to previous versions. If a certificate is on a OSCP or CRL list it will flat out deny access with no choice. Also, it doesn't 'grab' any root certs, otherwise anyone could just get any certificate validated by their own root and it would be accepted. It is a bit odd that it's not allowing acceptance of the certificate, but this can also be overriden in the IE settings – Mark Henderson Dec 21 '09 at 22:31

Check windows update to make sure there isn't a lingering (and optional) Root Certificate Update that you need to install.

share|improve this answer
I don't think their were any updates available, will check when back at work. – Steve Dec 30 '09 at 13:47
I've checked, no updates are available.. – Steve Jan 6 '10 at 19:36

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.