How to have an SSL Certificate installed in an Indy Server and seen as trusted?

Question

Using Delphi 2007, Indy 9 to build a standalone Server working in Secure mode.

I used SSLBuddy to generate the certificate request, got a root certificate and a standard certificate from GoDaddy, a MyDomain.crt, (I selected the "other" type as web server).
I then used SSLBuddy to generate the key and cert files passed to the TIdServerIOHandlerSSL.SSLOptions with the root cert.

The server starts OK and loads the certificate, but from the calling client, I get a warning that my certificate is not from a trusted authority, even if I manually add the (GoDaddy) root certificate to the Trusted Root Certification Authorities.

Is this the correct way of doing it or what did I do wrong?
Why is my GoDaddy certificate rejected as untrusted?

Any help VERY MUCH appreciated...

Answer 1

I have and Indy9 based web server that also handles SSL. I made it like this:

if FProxyObject.ProxySettings.SSLEnabled then
begin
  FIOHandlerSSL := TIdServerIOHandlerSSL.Create(nil);
  FIOHandlerSSL.SSLOptions.RootCertFile := FProxyObject.Certificates.RootCert;
  FIOHandlerSSL.SSLOptions.CertFile := FProxyObject.Certificates.ServerCert;
  FIOHandlerSSL.SSLOptions.KeyFile := FProxyObject.Certificates.ServerKey;
  FIOHandlerSSL.OnGetPassword := IOHandlerSSLGetPassword;
  FIOHandlerSSL.SSLOptions.Method := sslvSSLv23;
  FIOHandlerSSL.SSLOptions.Mode := sslmServer;

  FHTTPSSLServer := TIdHTTPServer.Create(nil);
  FHTTPSSLServer.ListenQueue := FProxyObject.ProxySettings.ListenQueue;
  FHTTPSSLServer.DefaultPort := FProxyObject.ProxySettings.SSLPort;
  FHTTPSSLServer.ServerSoftware := 'WebSurveyingSystem';
  FHTTPSSLServer.OnCommandGet := ServerCommandGetSSL;
  FHTTPSSLServer.IOHandler := FIOHandlerSSL;
  FHTTPSSLServer.Active := True;
end;

So you need a server certificate and a root certificate. Booth need to be from a trusted authority. You also need to define OnGetPassword like this:

procedure TProxyMain.IOHandlerSSLGetPassword(var Password: string);
begin
  Password := // set your certificate password here
end;

And that is all. From here on everything is as in normal HTTP connection as far as code goes. Just make sure your certificates are trusted and more important valid for you site URL.