One of our SSL provider's root certificate expired on 29 Dec 2009. They have a new one that expires in 2029.

Unfortunately, the website that uses the SSL certificate now throws an SSL error, indicating that the certificate cannot be verified because the issuer is unknown.

After some hasty research, we found that in order to get around this problem requires a convoluted process of updating the list of Root CAs on the local machine.

E.g. we'd have to download new CRT files from our SSL provider, then manually import them onto IE, Firefox, etc.

Clearly we cannot inform our everyday site users to update their computers as described above. How does one get over this issue?

Are we supposed to just wait for the browsers to update their list of Root CAs on their next scheduled update?

Although I have managed and installed new SSL certificates before, but I have never come across the situation where we had to update root certificates.

Hope someone can help point me in the right direction.

3 Answers 3


The short term solution that will 'fix' the issue would be to simply replace the certificate with one from an alternate vendor. Unfortunately this will mean you are going to have to buy ($$$) new certs.

Here is what the CA vendor suggests. They think you should just wait until browsers get upgraded or manually install certs. This is probably not acceptable for most people.

  • Individual SSL certs are fairly cheap. Prices go up for more validation, wildcard certs, etc. But the bottom line is that if you bought from IPS, you lose. Jan 11, 2010 at 1:21

Your SSL provider updated their root cert but didn't push it out to everyone's browsers with years of time to spare? I'd be finding myself a new CA, right quick, if that's the case. Given that we don't even know which provider you're talking about, specific instructions are impossible to give. I'd triple check that the intermediate certs are installed correctly; as much as I think commercial CAs are snakeoil vendors, I'm yet to hear of one that is quite this incompetent. You should contact your SSL provider and hassle them for how to fix this properly, and get a refund if they actually are that bad.

  • For the record, do a search on 'ipsca expiring' to read about the issue.
    – Zoredache
    Jan 11, 2010 at 0:50
  • 1
    All I can say is ZOMGWTFBBQ.
    – womble
    Jan 11, 2010 at 1:37
  • yes... my sentiments exactly... Jan 11, 2010 at 20:25

Unfortunately this appears to be a case of "you get what you pay for". The easiest and least painful solution is probably to replace your current cert with one from another vendor. Thawte (which is owned by Verisign) is the second largest public CA in the world and issues SSL certs for as low as $149.00 US.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .