Generated a IIS server certificate using my domain certificate authority (presumed to be an intermediate to the 'secret' root CA) via the Server Certificates -> Create Domain Certificate 'wizard'. Entered the FQDN of my server for the common name, filled out remaining form and hit Finish. Certificate is generated and shows up as a valid cert Issued by MYDOMAIN.FQDN and Issued to MYSERVER.FQDN. I changed the binding for 443 to use this new cert.
When I visit the site using:
Chrome - It doesn't give me the 'untrusted popup' but it does put a red line through the HTTPS part of the URL and when i check the details it says: "This site uses a weak security config SHA-1 so your connection may not be private"... I check the details of the certificate and it is indeed the same TLS 1.0 cert i had just enabled and I do see our MYDOMAIN.FQDN as a trusted intermediate certificate in the Chrome -> certificates menu.
Firefox - It gives me the popup saying "can't confirm that your connection is secure"... "The certificate is not trusted because the issuer certificate is unknown"... so I look for the MYDOMAIN.FQDN in Firefox's certificate menu and it's nowhere to be seen.
IE - Lets me right through and I do see MYDOMAIN.FQDN as a trusted intermediate certificate authority.
Why doesn't Firefox recognize MYDOMAIN.FQDN as a trusted intermediate certificate... shouldn't this be stored at the OS level (and as a member of the domain apply to all browsers?)
I fully understand the risk of using SHA1 and the discovered vulnerabilities... is Google just trying to push people out of using SHA1 by putting the (very visible) red line through the URL?
Is there a setting somewhere in my domain certificate authority that will default to SHA2 or better signature hashs as I didn't see an option for hash algorithm in the "Create Domain Certificate" wizard. I'm guessing I could go through the Create Cert Request -> Issuance in two steps and specify the hash algorithm.