Windows server users may encounter an “untrusted connection” error when accessing their websites, even after importing a PKCS#7 certificate with the full chain. This issue is more prevalent on mobile devices than desktops, particularly with Comodo certificates.
When inspecting the certificate installation using an online checker, you may notice that only one intermediate certificate is returned.
To comprehend the root of the issue and how to resolve it, it’s essential to understand how Windows servers interact with SSL certificates. Firstly, note that Windows servers do not transmit root certificates during the SSL handshake and construct certificate chains by selecting the shortest available route.
Let us investigate this issue using the example of a Comodo PositiveSSL certificate. PositiveSSL (and other Comodo certificates) has two variants of CA chain. One ends up with SHA-1 root certificate and the other is completed by a newer SHA-2 root, which is not included in trusted stores of most mobile devices and might be missing in old versions of desktop browsers.
Newer versions of Windows servers contain both AddTrust External CA Root (SHA-1 root) certificates and Comodo RSA Certification Authority (SHA-2 root). As you see from the screenshot above, the chain that ends up with SHA-2 root is shorter. Therefore, the server will prefer the chain file that ends up with Comodo RSA Certification Authority. Taking into account that the root certificate is not sent by the server gives us the end-entity certificate with one intermediate submitted to client and possible security warnings about the certificate being untrusted.
In order to overcome the issue, you’ll need to disable the usage of the root certificate that prevents building a proper certificate chain. Follow the steps below:
Step 1
Press Win+R, type in mmc and click OK to open Microsoft Management Console. Make sure that you are logged in as administrator.
FURTHER READING: |
| 1. How to convert certificates into different formats using OpenSSL |
| 2. SSL Certificate Installation in Plesk 12 |
| 3. How to Install SSL Certificate on Mac OS X/Yosemite/El Capitan |
Step 2
Click on File and choose Add/Remove Snap-in option.
Step 3
Select Certificates and click Add.
Step 4
Choose Computer account, and then Next.
Step 5
Select Local Computer radio button and click Finish.
Step 6
Click OK to apply the changes.
This will open a certificate manager, where you will be able to see the certificates added to the trusted stores (root and intermediate certificates that are integrated to a Windows server).
Step 7
Expand the Trusted Root Certification Authorities store and click on the Certificates folder. You will see all root certificates imported to your server here. The certificate we are interested in will be also here.
Step 8
Right-click on the required certificate and click on Properties.
Leverage 1Byte’s strong cloud computing expertise to boost your business in a big way
1Byte provides complete domain registration services that include dedicated support staff, educated customer care, reasonable costs, as well as a domain price search tool.
Elevate your online security with 1Byte's SSL Service. Unparalleled protection, seamless integration, and peace of mind for your digital journey.
No matter the cloud server package you pick, you can rely on 1Byte for dependability, privacy, security, and a stress-free experience that is essential for successful businesses.
Choosing us as your shared hosting provider allows you to get excellent value for your money while enjoying the same level of quality and functionality as more expensive options.
Through highly flexible programs, 1Byte's cutting-edge cloud hosting gives great solutions to small and medium-sized businesses faster, more securely, and at reduced costs.
Stay ahead of the competition with 1Byte's innovative WordPress hosting services. Our feature-rich plans and unmatched reliability ensure your website stands out and delivers an unforgettable user experience.
As an official AWS Partner, one of our primary responsibilities is to assist businesses in modernizing their operations and make the most of their journeys to the cloud with AWS.
Step 9
Put the radio-button on Disable all purposes for this certificate, then click on Apply and OK. The changes should be implemented instantly.
Note: Alternatively, you can delete the certificate from the store, however, there is a chance it will appear again after the Windows server restart.
This should resolve the issue with the certificate chain returned by the Windows server and remove all the warnings in browser.