I have purchased a GeoTrust TrueBusiness ID SHA-256 with EV SSL Certificate.

According to GeoTrust website, I must also install the corresponding intermediate certificate, which is "GeoTrust EV SSL CA - G4".

Now, in turn, GeoTrust EV SSL CA - G4 is issued by "GeoTrust Primary Certification Authority".

This root CA seems to be missing from both many Windows 7 systems and android mobile devices. In such systems, the only two GeoTrust Root CAs installed are "GeoTrust Global CA" and "Equifax Secure Certificate Authority".

In this cases, the browser shows "this site is not secure" warning and you must manually add an exception to continue browsing. I understand this is like that because there is no valid root CA to validate de certificate.

In order to solve this (ie. support for systems that do not have "GeoTrust Primary Certification Authority" among their available CAs), GeoTrust website says the following:

If you need to support legacy browsers, operating systems, customized applications and devices that do not have the GeoTrust Primary Certification Authority, install the cross-certificate along with the intermediate ca above. Click here

When you follow that link, you go to the cross-root certificate download page, that crosses "GeoTrust Primary Certification Authority" with "Equifax Secure Certificate Authority", which seems to be the most legacy (and thus widely supported) root CA.

So far, so good. But, there is a caveat. This cross-root certificate only comes in a SHA-1 flavor. So now, in newer systems, the browser shows a warning because there are insecure (SHA-1) certificates as part of the chain.

Does this mean this is an inevitable trade-off? Do I have to chose between leaving out the legacy users who don't have the newer root CA in their trusted store and the newer users with systems that only accept full SHA-256 chains?

Is this more a commercial than technical problem? (Should I buy another, perhaps more expensive - and compatible - certificate?). Am I greatly misunderstanding something here?


  • Have you tried GeoTrust's customer support? As you're a paying customer, they should help you through proper installation and configuration. – Neil Smithline Jul 22 '16 at 20:25
  • I've aquired the certificate through a reseller and they seem to know as much about this as I do. – jotadepicas Jul 23 '16 at 3:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.