As far as I know: when we make an ssl connection to a site we receive the site certificate, the browser check if the site certificate is in its list of root and trusted certification.
So if the CA is NOT in the browser trusted roots the connection should fail!
I made a connection to saba.bankmelli-iran.com, the site is verified by KEYNECTIS,
- I can find this CA as a valid root in firefox so I expect firefox connect to this site without any problem, and it does ! ( I find the certificates at preferences#advanced#view-certificates#Authorities menu)
- I can not find the KEYNECTIS in IE CA valid roots, I expect that IE does not trust this, but it goes and I get now Certification Warning. (I find the roots at internet_options#content#certificates#trusted_root_certification_authorities menu)
Why does IE trust this CA?
Here is a screenshot of IE Key store