CODEWITHSUNDEEP
internet-explorersslcertificate
mr.nothing
mr.nothing

Reputation: 5399

Internet Explorer 9 warns about invalid site certificates

I've written an application that uses some flash components. To allow these flash components to work with other machines, I need to accept certificates from these machines or skip certificate errors permanently on user machines to accomplish this.

I tried the following, but none of this worked for me:

  1. Install certificate to the Trusted Root Certification Authorities.
  2. Adding the site to the trusted sites in Internet Explorer.
  3. Clearing the SSL cache, browsing history, browser cache, etc.
  4. Uncheking "Warn about certificate address mismatch" in the Advanced tab of Internet Explorer settings.
  5. Unchecking "Check for publisher's/server certificate revocation". Rebooting machine, reloading IE, and cleaning the Windows registry.

Nothing stated above was able to help me.

I also have read/heard 'warn about invalid site certificates' setting in Internet Explorer (this article states it exists), but I haven't find it in the Internet Explorer 9 settings.

Could somebody suggest any way of how certificate warning can be skipped?

Thanks in advance!

p.s. Here is what the warning states:

Upvotes: 2

Views: 8052

Answers (2)

Ed999
Ed999

Reputation: 3091

Yes, I'm fully aware that this is a very old thread.

But after doing research on this problem, in Windows 7, I came up with a new solution, one which actually works -- and one which I haven't seen suggested anywhere online.

I'm posting it here (which might or might not be the ideal place for it!!) on the assumption that the nature of my solution potentially makes this a valid fix for ANY version of Internet Explorer! As a fix, it's a bit conventional, so I'm surprised I've never seen anyone propose it before.

.

This is a fix for when the IE browser reports a red 'Certificate Error' notice in the URL address bar.

  1. Click in Internet Explorer, on the red 'Certificate Error' notice in the URL address bar.
  2. Click on 'View Certificate'.
  3. Export the Certificate to the Desktop (save it as type .p7b and choose the option to save the whole chain of certificates) [a "PKCS #7 Certificate" is saved].
  4. Go to: Start > Run
  5. Type mmc then click 'OK', to launch the mmc snap-in.
  6. In the mmc snap-in, go to: File > Open
  7. Open 'Console1.msc'
  8. Import the saved certificate, from the Desktop: Action > All Tasks > Import
  9. Save it in: Trusted Root Certification Authorities

.

How to create 'Console1.msc' -

  1. Go to: Start > Run
  2. Type mmc then click 'OK', to launch the mmc snap-in.
  3. Go to: File > Add/Remove snap-in
  4. In 'Available snap-ins', highlight/click 'Certificates' and then click 'Add'
  5. Select 'Computer account' then click 'Next'
  6. Select 'Local computer' then click 'Finish'
  7. Click 'OK'
  8. Save the snap-in for future use: File > Save As and save it as 'Console1.msc'

Upvotes: 0

EricLaw
EricLaw

Reputation: 57125

Adding the certificate to the Trusted Root CA store will resolve the "The security certificate presented by this website was not issued by a trusted certificate authority." message. Note that you need to trust the root certificate that the server's certificate chains to, which may or may not be the same certificate that the server sent.

The "Warn about certificate address mismatch" checkbox resolves the "Security certificate presented for this website was issued for a different website's address" error only. It's unsafe to uncheck this box because it applies to all sites.

Changing "Check for publisher/server certificate revocation" will not help you.

If you're doing this only for test purposes, consider simply running Fiddler in HTTPS-decryption mode. Fiddler will hit the certificate error and you can ignore it for the lifetime of the Fiddler session.

Alternatively, your best approach is to simply fix the certificate on the other server. If it's self-signed and you don't want to pay for a CA certificate, at a very minimum you should update the self-signed certificate to contain the proper CN or SubjectAltName to match that server's hostname.

Upvotes: 3

Related Questions