3

In our Intranet. we have a site (https://site1) configured with SSL using a generated certificate for a different site URL (https://site2).

Chrome/FF/IE/Edge browsers are showing invalid certificate error messages.

Error message on Chrome:

Your connection is not private

Attackers might be trying to steal your information from my.pod6.people.test.com (for example, passwords, messages, or credit cards). NET::ERR_CERT_AUTHORITY_INVALID

Automatically send some system information and page content to Google to help detect dangerous apps and sites. Privacy policy Back to safetyHIDE ADVANCED This server could not prove that it is my.pod6.people.test.com; its security certificate is not trusted by your computer's operating system. This may be caused by a misconfiguration or an attacker intercepting your connection. Learn more.

Proceed to my.pod6.people.test.com (unsafe)

Error message on Firefox:

https://my.pod6.people.test.com/

Peer’s Certificate issuer is not recognized.

HTTP Strict Transport Security: false HTTP Public Key Pinning: false

Certificate chain:

-----BEGIN CERTIFICATE-----

certificate

-----END CERTIFICATE-----

How do I get these browsers to trust my site's SSL certificate and ignore the error in the future?

I tried adding the site certificate to Windows Trusted Root Certificate store, is that the right place?

Add to root CA

Improve this question
2
  • 2
    Apart from the missing details requested by @OscarAkaElvis - Firefox does not use the Windows CA store, i.e. you need to add it to the Firefox trust store too. Chrome instead uses the same trust store as Edge. Please check also that your self-signed certificate is really a CA certificate, i.e. has CA true in basic constraints.
    – Steffen Ullrich
    Commented Jun 27, 2017 at 18:35
  • if you google "How to force browser to trust a self-signed cert" I get a lot of hits. I think you just needed to add that one detail.
    – schroeder ♦
    Commented Jun 28, 2017 at 7:20

1 Answer 1

Reset to default
3

Just to be clear, are you adding the self-signing CA root cert you will be using to sign other certs with? That's what needs to go in the "Trusted CA" store. The self-signed "leaf" cert you want the browser to trust doesn't go there.

"Trusted Root CAs" that you have highlighted is where to put the public key of the Certificate Authority (e.g. LetsEncrypt, Verisign, your in-house signing CA being used...) If you are going to be your own CA and sign your own certs, and want your system to trust those, you need to put your CA public key there.

From your description though, it sounds like you got a site cert signed by some existing CA, and you want your browsers to trust it.

In that case, you are putting it in the wrong place. You want either "Personal" or "Trusted publishers" but that's still just for the OS to trust it. As @Steffen Ullrich commented above, you will also need to add your self-signing CA's public key to the browsers trustStore to do what you probably want.

Improve this answer
3
  • 1
    I think, he tried to install a copy of server cert in Trusted Root CAs store. Though, the cert might not be self-signed. I noticed this on SE boards, that many OPs call any certificate self-signed..like "got self-signed cert from XYZ", for example. Just because they heard this term..without putting any meaning in it.
    – Crypt32
    Commented Jun 27, 2017 at 19:57
  • Sorry for the confusion, the SSL is not from any CA - it's generated by ourselves. I'm trying to force the browsers to trust this certificates.
    – Dio Phung
    Commented Jun 28, 2017 at 7:11
  • @Crypt32 yeah people mislead the term self-signed. If they got it self-signed from XYZ then it's not self.
    – defalt
    Commented Jun 28, 2017 at 7:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .