What do I need to do to get Internet Explorer 8 to accept a self signed certificate?

Question

We use self signed certificates on our intranet. What do I need to do to get Internet Explorer 8 to accept them without showing an error message to the user? What we did for Internet Explorer 7 apparently isn't working.

EDIT: Internet Explorer 7 wouldn't show any errors if I put the certificate into trusted root certification authorities. Internet Explorer 8 seems to show errors even with the certificate there.

put it into the certificate into trusted root certification store — , Mar 25 '09 at 14:20
Do you have the screenshot for IE 8 error.? What does it show on the certificate path page? Make sure you added the CA, not the site cert. — J-16 SDiZ, Jun 29 '09 at 01:00
This isn't a programming question. I'd suggest migration to ServerFault. — David Thornley, Sep 11 '09 at 17:23
These debates about where the question belongs are absurd. Seriously, wtf. While it might fit any of the suggested sites, it is absolutely reasonable as a developer question because it is something web _developers_ often face. — jpswain, Jun 07 '11 at 23:33

score 361 · Answer 1 · edited Jun 13 '13 at 16:21

361

How to make IE8 trust a self-signed certificate in 20 irritating steps

Browse to the site whose certificate you want to trust.
When told “There is a problem with this website's security certificate.”, choose “Continue to this website (not recommended).”
Select Tools➞Internet Options.
Select Security➞Trusted sites➞Sites.
Confirm the URL matches, and click “Add” then “Close”.
Close the “Internet Options” dialog box with either “OK” or “Cancel”.
Refresh the current page.
When told “There is a problem with this website's security certificate.”, choose “Continue to this website (not recommended).”
Click on “Certificate Error” at the right of the address bar and select “View certificates”.
Click on “Install Certificate...”, then in the wizard, click “Next”.
On the next page select “Place all certificates in the following store”.
Click “Browse”, select “Trusted Root Certification Authorities”, and click “OK”.
Back in the wizard, click “Next”, then “Finish”.
If you get a “Security Warning” message box, click “Yes”.
Dismiss the message box with “OK”.
Select Tools➞Internet Options.
Select Security➞Trusted sites➞Sites.
Select the URL you just added, click “Remove”, then “Close”.
Now shut down all running instances of IE, and start up IE again.
The site’s certificate should now be trusted.

edited Jun 13 '13 at 16:21

Rory O'Kane

29,210
11
96
131

answered Sep 11 '09 at 16:57

Aya

39,884
6
55
55

25

In IE 8 (I'm on windows 7), after step 5, uncheck "Enable Protected Mode". Then you can install the cert. But, even after installing the cert, I continue to get the warning and red location bar. – Josh Apr 07 '10 at 14:20
1

I haven't used Windows 7, so it's possible things have changed. The key points are:- 1. Ensuring the certificate issuer name precisely matches the domain name of the URL you're using it for. 2. Ensuring the certificate is in the "Trusted Root Certification Authorities" store. 3. Ensuring you've shut down and restarted ALL instances of IE after installing the cert. It's possible that an embedded ActiveX version of IE in another application, or some other hidden process may be interfering with point #3, so to be absolutely certain that's not the issue, try a complete system reboot. – Aya May 21 '10 at 15:59
I'm running IE8, but on Windows XP. (Please don't even ask.) I was able to install the certificate into trusted root certificate authorities without needing to go through adding the site to trusted sites, and just taking all the default options in the install certificate wizard. YMMV. – Greg Charles Mar 17 '11 at 18:21
17

+1 for the title :) Step #12 was most useful; didn't figure that one out on my own. – jpswain May 10 '11 at 19:32
1

You can skip the trusted site steps if you close all instances of IE and then run IE elevated. IE on XP does not need the trusted site steps because some of the trust mechanisms IE8 used were introduced in Vista and won't be used when running on XP. – SuperIronBob Sep 15 '11 at 18:54
3

I double checked the address is the same but I needed to do this to work: Clicked on Tools Clicked on Internet Options Clicked Advanced Scrolled down to "Check for publisher's certificate revocation." and unchecked this. Clicked Apply Clicked OK Closed and reopened the browser http://www.techsupportforum.com/forums/f56/how-to-turn-off-certificate-warning-518108.html – Akira Yamamoto Feb 01 '13 at 17:55
@AkiraYamamoto That means your self-signed cert has been revoked. By changing that option in yourbrowser, you're trusting _all_ revoked certificates. Not the safest choice... – Basic Jul 05 '13 at 23:56
2

If, like me, you are using an old VM to test IE8 on windows XP, remember to make sure your system clock is accurate. This plays a part in certificate verification. – AlexMA Sep 13 '13 at 20:09
1

Instead of placing it "Trusted Root Certification Authorities", choose a lesser privileged store such as "Trusted People". That allows you to trust just this site's certificate and not everything from that CA. – Mrchief Jan 26 '14 at 18:21
To get this to work, I had to click the "Show physical stores" button on the import wizard, and select the "Registry" for Trusted Root CA store, then reboot the machine. – Paul Taylor Apr 29 '14 at 09:51
18

These steps didnt work for IE 11. Is there some other thing that needs to be done there? – user20358 Sep 05 '14 at 04:29
2

The steps did work for me in IE11, just make sure that you have the same domain in the certificate – Dany Khalife Oct 09 '14 at 01:11
2

I do have the same domain in the certificate with a wildcard. I am attempting this on our DEV server which is a windows 2012 server box – user20358 Nov 04 '14 at 10:08
http://blogs.msdn.com/b/saurabh_singh/archive/2007/11/07/you-get-a-security-alert-when-you-try-to-access-an-ssl-enabled-web-site-when-certificate-has-been-issued-by-an-internal-root-ca.aspx solved it for me – mhn Jan 28 '15 at 08:17

score 71 · Answer 2 · edited Jan 13 '15 at 11:59

71

I got it working like this

Start Internet Explorer running as a user with administrative privileges.
Browse to server computer using the computer name (ignore certificate warnings)
Click the ”Certificate Error” text in the top of the screen and select ”View certificates”
In the Certificate dialog, click Install Certificate -> Next
Select Place all certificates in the following store -> Browse
Check Show Physical Stores check box
Select Trusted Root Certificate Authorities – Local Computer
Click OK – Next – Finish – OK
Restart Internet Explorer

edited Jan 13 '15 at 11:59

Nicholas Murray

13,305
14
65
84

answered Jun 02 '10 at 06:47

Jay67A

711
5
2

23

Theses steps worked for me but i had to check the *physical store checkbox and chose the *trusted people *local computer. I tried every single other combination and nothing worked except this. IE11 – Diego Frehner Dec 15 '14 at 07:07
6

This is the best answer as the top answer does not have the crucial 'Start Internet Explorer running as a user with administrative privileges.' – Nicholas Murray Jan 13 '15 at 11:59
2

I didn't have "Trusted People, Local Computer" as an option, so I just clicked "Trusted People" instead and it worked. – Alex Angas May 19 '15 at 04:55
2

I also just selected "Trusted People" and it worked. Note I was testing on a Windows 8 PC. Storing the certificates in other location did not seem to work, I was only successful with "Trusted People". – ScottyG Aug 03 '15 at 14:35
1

It worked for me when I selected 'Trusted People' -> 'Local Computer' option. To get the 'Local Computer' option, please run the IE in 'Run As Administrative privileges' mode. I am using Win7 and IE11 – Sagar S. Nov 07 '17 at 06:41

score 28 · Answer 3 · answered Feb 06 '12 at 11:40

I have tried lots and lots of steps from different people posted on different websites. But none of them mention that I should add the certificate into the Trusted People keystore.

That's right, placing it under trusted CA is not enough for my case, I have to put the certs inside the Trusted People also.

That's:

Run MMC
Add Certificate Snap-in choose Local Computer
Expand Certificates(Local Computer) -> Trusted People -> Certificates
Right click All Task -> Import
Finish the wizard

To export the certificate:

Run IE as admin (right click, run as admin)
When prompted invalid cert, go ahead visit the website anyway
Click the certificate error near the address, click view certificate
Go to Details tab, click Copy To file
Save as *.cer file.

I'm on IE9, Windows 7

+1 I used this to figure out that on IE 10 on Win8 x64 you Run IE As Admin, navigate through, then click on the error up to, and use the Install Cert button from there, selecting Trusted People as the destination (no `certmgr.msc` required) — Ruben Bartelink, Jan 17 '13 at 11:35

score 21 · Answer 4 · edited May 30 '11 at 18:30

21

Make sure that your self-signed certificate matches your site URL. If it does not, you will continue to get a certificate error even after explicitly trusting the certificate in Internet Explorer 8 (I don't have Internet Explorer 7, but Firefox will trust the certificate regardless of a URL mismatch).

If this is the problem, the red "Certificate Error" box in Internet Explorer 8 will show "Mismatched Address" as the error after you add your certificate. Also, "View Certificates" has an Issued to: label which shows what URL the certificate is valid against.

edited May 30 '11 at 18:30

Peter Mortensen

30,738
21
105
131

answered Jul 17 '09 at 21:02

Gabe Moothart

31,211
14
77
99

1

Great answer, "Mismatched Address" is the error I have. I thought I had a problem installing the certificate but actually it seems the certificate installed fine, it's just a bit b0rked. – demoncodemonkey May 19 '11 at 15:48
1

To expand on this a bit for subdomains. The issue does not persist with self-signed wildcard certificates. `issued to: *.example.com` So if you have several self-signed subdomains you are trying to get IE to accept, you can create a single wildcard certificate and update the certificate locations to the wildcard certificate. Be mindful if using subsubdomains `a.b.example.com` as you will have to create a separate wildcard certificate for the subsubdomain `*.b.example.com` (NOT `*.*.example.com`) for it to work in IE as well. – Will B. Apr 07 '14 at 16:30
This was the answer for me after trying everything above and elsewhere. Mismatched address. Thanks! – Kon Apr 28 '16 at 21:22

score 16 · Answer 5 · answered Oct 12 '11 at 10:40

16

If you're getting an address mismatch error, just allow address mismatches:

Tools and select Internet Options
select the Advanced tab
Scroll down and uncheck Warn about certificate address mismatch

answered Oct 12 '11 at 10:40

Alister Scott

3,675
24
41

This prevents the warning message but the address bar is still red – Russell Jan 06 '12 at 01:44
2

To update the certificate to the correct URL use this blog: http://www.robbagby.com/iis/self-signed-certificates-on-iis-7-the-easy-way-and-the-most-effective-way/ - the crux is use a 3rd party exe (selfssl.exe) and create a certificate (and assign it to the site) with a custom URL. – Russell Jan 06 '12 at 01:45
THANK YOU FOR THIS! I followed 2-3 steps above and still got the warning. This step was the only thing that worked after importing the cert about half a dozen times. Thank you! – Tensigh Dec 15 '17 at 01:45
IE11 on Win10: After importing the certificates as described by Jay or Aya, I still got the certificate error. Only after unchecking the warning and rebooting, the self-signed certificates were accepted (without the address bar being red). – Elektropepi Jan 29 '19 at 09:57

score 9 · Answer 6 · answered Jan 16 '10 at 18:48

Man, today I've spent a few hours fighting this problem. No matter what I did in the IE 8, the problem remained. The certificate installed by the IE appears in the Trusted Root Certification Authorities of the client PC, however the IE still complains no matter what.

Here's the solution I've discovered:

On the web server:

Win+R, MMC, Enter.
File, Add-Remove snap-in, Certificates, Add, Manage certificates for: my user account, Finish, OK.
Navigate to "Certificates - current user / Trusted Root Certification Authorities / Certificates".
Find your certificate, right-click, All tasks / Export.
"No, don't export the private key"
"DER Encoded binary X.509 (.CER)"
Save the file somewhere.
Transfer the newly created .CER file to the client PC.

On the client machine:

Win+R, MMC, Enter.
File, Add-Remove snap-in, Certificates, Add, Manage certificates for: my user account, Finish, OK.
Navigate to "Certificates - current user / Trusted Root Certification Authorities / Certificates".
Right-click on Certificates container, All tasks / Import
Choose your .CER file you've transferred from the server machine.
On the next screen, choose "Place all certificates in the following store", click "Browse", check "Show physical stores", then choose "Trusted Root Certification Authorities / Local Computer".
Press "Finish" finally.
In Internet Explorer: Tools - Delete browsing History,
In Internet Explorer: Tools - Internet options - "Content" tab - Clear SSL state button.

score 5 · Answer 7 · edited Feb 26 '10 at 15:22

Here is how I got it to work in IE8:

Go to the website in question, https://xxx.yyy.com, for instance,
Click through until you get to the Certificate error in the browser status line.
View the cert, then from the Details tab, select Copy to File.
Save to the desktop as xxx.cer, for example,
Start, Run, MMC.
File, Add/Remove Snap-In,
Select Certificates, Click Add, My User Account, then Finish, then OK,
Dig down to Trust Root Certification Authorities, Certificates,
Right-Click Certificate, Select All Tasks, Import,
Select the Save Cert from the Desktop
Select Place all Certificates in the following Store, Click Browse,
Check the Box that says Show Physical Stores, Expand out Trusted Root Certification Authorities, and select Local Computer there, click OK, Complete the Import,
Check the list to make sure it shows up. You will probably need to Refresh before you see it. Exit MMC,
Open Browser, select Tools, Delete Browsing History
Select all but Inprivate Filtering Data, complete,
Go to Internet Options, Content Tab, Clear SSL State,
Close browser and reopen and test.

Any advice on what to do if "Copy to File..." is disabled? – jessegavin Apr 09 '10 at 19:36 — jessegavin, Apr 09 '10 at 19:36
@jessegavin: run IE as administrator – ryber Feb 07 '11 at 16:55 — ryber, Feb 07 '11 at 16:55

score 3 · Answer 8 · answered Mar 25 '09 at 13:58

3

You should install your certificate as a trusted authority on your computer.

There are numerous way to do that, for exampe you could use mmc (start/run/mmc), add the Certificates Snap-In, and from there you can install your self-signed certificate.

There's no way around that because the whole point of certificates is to warn the user if the website he's visiting has not been certified by a trusted authority.

answered Mar 25 '09 at 13:58

Brann

31,689
32
113
162

Is there any way to do this other than logging into every single machine? – Mar 25 '09 at 13:59
if you're in a corporate environment, and if your company has a certificate installed as a trusted authority on all its computers (which is a common setup), you could use this certificate to sign yours instead of a self-signed certificate – Brann Mar 25 '09 at 14:02
It's also possible to install certificates from the command line, so it's definitely possible to automate. How to do that heavily depends on what tools your sysadmins use. – Brann Mar 25 '09 at 14:03
2

IE7 worked if I installed the cert on the local machine. IE8 seems to throw a warning even if I put the signing certificate (this one is self-signed) in trusted root certification authorities. I'm willing to forget the group policy angle for now - I can't even make it work on a single machine. – Mar 25 '09 at 14:17

score 2 · Answer 9 · answered Sep 23 '09 at 14:39

2

It's not enough to install the certificate itself, instead you need to install the root certificate of your certification authority. Say if you use Win Server's Certificate Services, its root certificate which was created when CS was installed on that server is the one to be installed. It must be installed to the "Trusted Root Certification Authorities" as described earlier.

answered Sep 23 '09 at 14:39

3

The definition of a self-signed cert is one where the root CA is the cert itself. By trusting the cert it will be inherently trusted. – Derek Dysart Jun 13 '11 at 21:31
1

Worth pointing out for anyone else who comes here in future that `https://server` and `https://server.example.com` are different and if the IT dept has done it's stuff correctly you'll probably need the fully qualified domain name. – PeterI Sep 15 '11 at 19:23

score 2 · Answer 10 · answered Jun 13 '16 at 12:37

This may help someone I am on IE11 windows 7 and what I did In addition to install the certificate is Going to internet options ==> advance tab == > security ==> "remove the check " from warn about certificate address mismatch in addition to below - dont forget to close All IE instances and restart- after finishing :

1-Start Internet Explorer running .

2-Browse to server computer using the computer name (ignore certificate warnings)

3-Click the ”Certificate Error” text in the top of the screen and select ”View certificates”

4-In the Certificate dialog, click Install Certificate -> Next

5-Select Place all certificates in the following store -> Browse

6-Install to the trusted root Certification ..

then restart .

Hope this help someone .

score 1 · Answer 11 · edited May 30 '11 at 18:27

1

You can use GPO to use the certificate within the domain.

But my problem is with Internet Explorer 8, that even with the certificate in the trusted root certification store... it still won't say it's a trusted site.

With this and the driver signing that needs to be done now... I'm starting to wonder who owns my computer!

edited May 30 '11 at 18:27

Peter Mortensen

30,738
21
105
131

answered Jun 29 '09 at 00:56

If the issuer is a trusted root, then probably the cert has something wrong with it. Does the Canonical Name on the cert match the hostname the user uses to access the site? Is the current time within the validity range of the cert? – Yuliy Jan 13 '10 at 19:12

score 1 · Answer 12 · edited May 30 '11 at 18:37

Unfortunately none of the solutions worked for me. I used Internet Explorer 8 on Windows 7. When I was looking for a solution, I found the settings about login information in the control panel. So I added a new entry under the certificate based information with the address of my server and I chose my prefered certificate.

After a clear of the SSL cache in Internet Explorer 8 I just refreshed the site and the right certificate was sent to the server.

This isn't the solution which I wanted, but it works.

score 1 · Answer 13 · answered Jan 06 '12 at 01:49

1

As everyone else has mentioned, the first task is to add the certificate to the Trusted Root Authority.

There is a custom exe (selfssl.exe) which will create a certificate and allow you to specify the Issued to: value (the URL). This means Internet explorer will validate the issued to url with the custom intranet url.

Make sure you restart Internet Explorer to refresh changes.

answered Jan 06 '12 at 01:49

Russell

17,481
23
81
125

This is excellent advise, I think for the "Address Mismatch Error" this is the proper way to do it, I tried all the other ones to no avail. What really lead to the solution was your comment(including this [link](http://www.robbagby.com/iis/self-signed-certificates-on-iis-7-the-easy-way-and-the-most-effective-way/)) to @AlisterScott. – David Rogers Nov 16 '16 at 19:33

score 0 · Answer 14 · edited May 23 '17 at 12:34

You need to make sure that the Self Signed Certificate uses the correct common name for the domain you are setting up. If you are going to use the same certificate for multiple domains you need to either have a unique certificate for each domain, or if all of your ssl sites are subdomains of a common domain, then you can generate a certificate with a wildcard domain like *.domainname.tld.

If you don't set up your common name correctly in your self signed certificate then Chrome and Firefox may work, but IE might not be able to find the certificate when you load the site each time. In IE it will appear like you have added the site's cert but in fact on page load it will never be found.

how to set up SSL for Apache for a Mac so I can test Cross Domain iFrame on IE8

score 0 · Answer 15 · answered Dec 11 '09 at 04:26

It doesn't look like it's possible to not have the certificate error any more. I'm on Windows XP with IE 8. Group Policy had installed a self-signed certificate as a trusted root certificate for access to an internal site. When I look at MMC with the certificate snap-in I can see the certificate there OK.

When I look at:

Internet Options => Content => certificates

It isn't there!

This behaviour in IE started since our admins let loose with the last lot of Patch-Tuesday updates which installed on my machine on 10th Dec 2009. Prior to that it was quite happy to accept the certificate as valid.

score 0 · Answer 16 · answered Nov 13 '13 at 18:46

How to install the CA Root Cert, and not the Website Cert: (IE8, Win7)

When you bring up the certificate details you are looking at the website cert, and not the CA cert. The General tab will say, "This certificate cannot be verified..." You need to select the CA by clicking on the Certification Path tab, and selecting the top most cert in the path. It should have a red X icon, and should say, "This CA Root certificate is not trusted because..." Click the View Certificate button, and on this new General tab you should see, "This CA Root is not trusted..." This is the certificate that you want to import into the Trusted Root Certificate Authority.

Once you have imported the CA, you do not need to import the regular website cert. That cert will get matched up to the CA you just imported, and IE will treat everything as working normally. You do not need to run IE as Admin, and you do not need to add the site to trusted sites first. You do need to restart IE after the import.

score 0 · Answer 17 · answered Jan 13 '10 at 19:28

I had the same issue while working with web services. Here Microsoft has a (long) walk-thru showing you how to install stuff on the client to basically say that your self-signed cert is ok. In the end, I just spent the $30 and bought a full certificate from Godaddy.com.

P.S. I know that you can code around the error message but we didn't want to do that for testing reasons.

score 0 · Answer 18 · answered Jul 28 '15 at 09:10

I tried all mentioned solutions but none of them worked. Using Internet Explorer 11 (11.0.9600.17914), there was no way of accepting invalid certificates as the error looked exactly as an 404.

What helped was the following: - add host to trusted sites (as mentioned a couple of times here) - disable TLS 1.2 and enable SSL 1.0 & SSL 2.0

The last step is something you should ONLY DO if you know what you're doing. We need to use a pretty strange setup here at work, thus we couldn't find another way of getting access to the system. Usually, downgrading security like that should not be done.

score 0 · Answer 19 · answered Mar 02 '16 at 21:38

If you are doing some local testing and that you add some alias in the hosts files say

127.0.0.1 www.mysite.com

and try to use any of the above procedures you will fail. The reason is that you will import a certificate for localhost. The certificate URL won't match.

In that situation you will have to generate a self-signed certificate and THEN import it as described above.

If you are using Xampp the generation of the correct certificate can be done easily using c:\xampp\apache\makecert.bat

score 0 · Answer 20 · answered May 22 '17 at 22:46

You can use CertMgr to add a certificate as a trusted publisher or if it is self-signed, as a root certificate

CertMgr.exe /add CertificateFileName.cer /s /r localMachine root

See Microsoft's documentation here:

https://learn.microsoft.com/en-us/windows-hardware/drivers/install/using-certmgr-to-install-test-certificates-on-a-test-computer

score 0 · Answer 21 · edited May 30 '11 at 18:23

0

What were you doing before? For self-signed certificates, I would normally install the certificate locally on the client system.

You may be able to use Group Policy to push a certificate to every system.

edited May 30 '11 at 18:23

Peter Mortensen

30,738
21
105
131

answered Mar 25 '09 at 14:00

Rob Haupt

2,104
1
15
24

What do I need to do to get Internet Explorer 8 to accept a self signed certificate?

21 Answers21

How to make IE8 trust a self-signed certificate in 20 irritating steps

Linked

Related