We ran PCI DSS External Vulnerability Scan on our website and the scan failed with many vulnerabilities, all of them are PCI severity: Low except one medium and another one high.
The high one is:
Threat: An SSL Certificate associates an entity (person, organization, host, etc.) with a Public Key. In an SSL connection, the client authenticates the remote server using the server's Certificate and extracts the Public Key in the Certificate to establish the secure connection. The authentication is done by verifying that the public key in the certificate is signed by a trusted third-party Certificate Authority. If a client is unable to verify the certificate, it can abort communication or prompt the user to continue the communication without authentication.
Impact: By exploiting this vulnerability, man-in-the-middle attacks in tandem with DNS cache poisoning can occur. Exception: If the server communicates only with a restricted set of clients who have the server certificate or the trusted CA certificate, then the server or CA certificate may not be available publicly, and the scan will be unable to verify the signature.
Solution: Please install a server certificate signed by a trusted third-party Certificate Authority. Result: Certificate #0 CN=132123-server1 unable to get local issuer certificate
And I have no idea how to solve this issue to pass this point when I rerun the scan. is there any steps I can follow?
The server is IIS 8
Website is using SSL wildcard from godaddy.