Earlier today I announced FloridaVacationAuction.com. Shortly thereafter an astute reader pointed out that there was a problem with the site's SSL certificate in FireFox. Figures, doesn't it?

Well, to be honest, I knew about the problem. The site was moved to one of my servers temporarily to avoid downtime due to Hurricane Wilma. As a part of this temporary move I exported the site's SSL certificate using the built-in mechanism in IIS 6.

Unfortunately, after moving the SSL certificate, visitors using FireFox who were prompted with a message which read "Unable to verify the identity of www.floridavacationauction.com as a trusted site." Because the server move is temporary and because not many of our visitors are using FireFox (yet) I decided to look the other way.

Well, of course, seeing as I blogged about the site today, a technical user ran into the problem and dropped me a message. This prompted me to get off my but and fix the problem, which I did.

Typically an error message like this indicates either that you're using a self signed certificate or that you are accessing site from a different URL than the SSL certificate was issued for. For instance, in my case a possible cause may have been that I was accessing the site at floridavacationauction.com, without the "www". Neither of these scenarios was true. In fact, I was on the correct URL and the certificate was issued by Verisign.

A little crafty Googleing turned up a page which indicated that the problem might be related to a missing certificate for an intermediate CA (certificate authority). I don't know much about this, but it seems that there is one root authority which bestows permission on other companies to sign certificates. This process forms a chain of trust which your browser verifies.

Unfortunately, it seemed that FireFox didn't recognize one of the intermediate CAs and was showing that error as a result. By searching around on Verisign's website I found their intermediate CA certificates. Unfortunately the instructions they provided to import it were not correct (or I couldn't get them to work).

I did a little more searching and found some instructions (on a competitor's website!). What follow are what I actually did to import the certificate into Windows Server 20003. I assume the process will be the same for Server 2000.

1. Copy the certificate into a file named verisign.cer on your web server. This name is arbitrary.
2. Click Start > Run and type MMC. This opens the Microsoft Management Console.
3. Click File > Add Remove Snap-in. This opens the Add/Remove Snap-in window.
4. In the resulting window click Add. This opens the Add Standalone Snap-in window.
5. In this window find the Certificates snap-in. Select it and click Add.
6. Select Computer account and click Next.
7. Select Local computer and click Finish.
8. Click Close and then Ok. Now you'll see the Certificates snap-in in the MMC.
9. Expand the Certificates node, right click on Trusted Root Certification Authorities and select All Tasks > Import...
10. Click Next then select the .cer file on the desktop and click Next again.
11. The next step in the wizard should indicate that the certificates will be placed in the Trusted Root Certification Authorities. If so, click next. If not, fix it.
12. Click Finish. You should get a message saying that the import was successful. If so, you're done!

I'm pretty sure you could also just right click on the .cer file and click Install Certificate. From this click though, but be sure to select the Trusted Certificates store.

Either way, once you're done the error message should go away in FireFox.

We're sorry, our spam filtering system has tagged your comment as spam. Please re-word your comment and try again.