Install Self Signed Certificate as Trusted Root on Windows XP


jospe

I have successfully installed a self signed certificate to Windows7. The process is to install it to the Trusted Root Certification Authorities (the local computer) first, and then install it to the trusted people (the local computer). (Without installing it to Trusted People, Internet Explorer 11 still warns that it cannot be verified by a trusted certificate authority).

I've tried repeating the same process on a Windows XP machine (yes, they persist even after the end of support :), but no luck. I still get a warning that the certificate cannot be verified by a trusted certificate authority. When I look at the certificate, Internet Explorer 8 shows me that. The certificate itself is missing (though I can see the certificate when looking in certmgr.msc). For some reason Internet Explorer chose to ignore this certificate. Any ideas?

jospe

View the certificate in Windows Certificate Manager (certmgr.msc). Windows says it "doesn't have enough information to verify this certificate". When looking at the certificate path, the only certificate shown is the certificate itself (with a yellow exclamation mark), and the certificate status indicates: "The issuer of this certificate could not be found".

I went through the details of the faulty certificate to find out why it was different from the others. The issuer's name is obviously correct, so that's not a problem. The field that caught my attention was "Authority Information Access" because it contained extra data with "URL=http:...name_of_domain.cer". The link points to the intranet used by the organization. I have downloaded the certificate on the intranet and installed it on the client. The certificate became valid and now it shows both certificates in the "Certificate Path"

Conclusion.. It turns out Windows XP is stupid for two reasons:

  1. For Windows XP , it is not enough to just install a certificate with a chain to a trusted root certificate . It will try to verify the root certificate until the top of its chain (which doesn't make much sense since it should be the root certificate and since Windows 7 doesn't follow this behavior and accepts the certificate as valid).
  2. Since both certificates have the same common name, Windows XP cannot show that the original certificate does have a chain. and makes tracking down the problem more difficult.

Hope this helps anyone who encounters this problem in the future. (Or as we know, not since Windows XP end of support :)

Related


Install Self Signed Certificate as Trusted Root on Windows XP

jospe I have successfully installed a self signed certificate to Windows7. The process is to install it to the Trusted Root Certification Authorities (the local computer) first, and then install it to the trusted people (the local computer). (Without installin

Keytool Create Trusted Self-Signed Certificate

sixtyfootersdude: I'm trying to create a self-signed certificate using (java) keytool, but when I try to use it, I get the following exception (see bottom for full exception). ...<5 more exceptions above this> Caused by: sun.security.validator.ValidatorExcepti

Keytool Create Trusted Self-Signed Certificate

sixtyfootersdude: I'm trying to create a self-signed certificate using (java) keytool, but when I try to use it, I get the following exception (see bottom for full exception). ...<5 more exceptions above this> Caused by: sun.security.validator.ValidatorExcepti

Add self-signed certificate to "Trusted List"

Naftuli Kay I've generated a self-signed certificate for my build server and I want to trust that certificate globally on my machine because I create the keys myself and I hate seeing warnings. I am on Ubuntu 12.04. How can I put the certificate and trust it g

Add self-signed certificate to "Trusted List"

Naftuli Kay I've generated a self-signed certificate for my build server and I want to trust that certificate globally on my machine because I create the keys myself and I hate seeing warnings. I am on Ubuntu 12.04. How can I put the certificate and trust it g

Trusted CA on self-signed certificate

horny I have an old Linux based embedded device from a project about ten years ago. The device has no built-in UI, keyboard or anything like that, just a small web server to control it. I have since forgotten the passcode on the device and the company that ori

Keytool Create Trusted Self-Signed Certificate

sixtyfootersdude: I'm trying to create a self-signed certificate using (java) keytool, but when I try to use it, I get the following exception (see bottom for full exception). ...<5 more exceptions above this> Caused by: sun.security.validator.ValidatorExcepti

Add self-signed certificate to "Trusted List"

Naftuli Kay I've generated a self-signed certificate for my build server and I want to trust that certificate globally on my machine because I create the keys myself and I hate seeing warnings. I am on Ubuntu 12.04. How can I put the certificate and trust it g

Add self-signed certificate to "Trusted List"

Naftuli Kay I've generated a self-signed certificate for my build server and I want to trust that certificate globally on my machine because I create the keys myself and I hate seeing warnings. I am on Ubuntu 12.04. How can I put the certificate and trust it g

Trusted CA on self-signed certificate

horny I have an old Linux based embedded device from a project about ten years ago. The device has no built-in UI, keyboard or anything like that, just a small web server to control it. I have since forgotten the passcode on the device and the company that ori

android studio: https self-signed certificate not trusted

eitan 03 Trying to access https://localhost:5000/ with my own self-signed certificate via android studio (using kotlin) , but I keep getting the error: java.security.cert.CertPathValidatorException: Could not find trust anchor for certificate path . I have mad