1

For installation of a certificate I needed to install the root and intermediate certificates as well. This was recognized (after IIS reset) by Firefox and IIS at once, but not by IE, Opera or Network4All. After a physical restart it was recognized by all.

My question is: how can I install the root and intermediate certificates without restarting the entire server? (and, of less importance, come that Firefox recognized this at once, but others didn't)?

Improve this question

3 Answers 3

Reset to default
2

I think you are seeing Firefox work because firefox most likely already had copies of the root and intermediate installed in its own stores, (which I have mixed feelings about). It seems like browsers are frequently importing intermediate certificates as well as roots into their own keystores now. That's one reason why I use cURL and the CA-provided certificate validation tool to verify the installation whenever I replace a cert.

I've had the problems with IIS you are describing if I installed the cert prior to installing the Intermediate cert but never had issues if the intermediate certs were imported prior to importing the server cert. Unfortunately, depending upon the CA, one does not always realize that the intermediate cert has been replaced until server cert verification is being performed.

Improve this answer
1
  • Perhaps you're right and it would've worked had I installed the root and intermediate certificates first. Not a 100% answer to the question but closest to an explanation for Firefox's behavior and why a restart might've been necessary.
    – Abel
    Nov 7, 2011 at 8:59
2

I spent one day trying to configure the right certificate chain on a windows 2008 R2 server and I realized after several hours that in my case the only IIS restart didn't work.

The right solution was to import the right certificates using MMC snap in the Root certificate authority and in the Intermediate certification authority, restart the web server and the certificate chain started to work.

This on IIS 7.5 Windows 2008 R2.

Improve this answer
1

Root certificate installation on Windows should never require a restart. Something else is going on here.

Worst-case, a logoff/logon should have worked - the apps you're describing all look like they're client/user-space apps, and terminating the process and restarting it is likely enough.

Improve this answer
3
  • Well, I would agree with you, if not for the simple fact that it only started working after I issued a full restart. The IIS service itself was restarted before that, but that didn't help.
    – Abel
    Nov 7, 2011 at 8:57
  • I'd acquiesce, but we're talking about client behavior versus server behavior: you restarted the service with no effect, then restarted everything, client and server. Anyway, no big deal; IIS doesn't need to be restarted was the key point.
    – TristanK
    Nov 7, 2011 at 9:46
  • *always/typically/insert special case here
    – TristanK
    Nov 7, 2011 at 9:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.