What do I need to do to get IE8 to accept a self signed certificate?

Question

We use self signed certificates on our intranet. What do I need to do to get IE8 to accept them without showing an error message to the user? What we did for IE7 apparently isn't working.

EDIT: IE7 wouldn't show any errors if I put the certificate into trusted root certification authorities. IE8 seems to show errors even with the certificate there.

Answer 1

You should install your certificate as a trusted authority on your computer.

There are numerous way to do that, for exampe you could use mmc (start/run/mmc), add the Certificates Snap-In, and from there you can install your self-signed certificate.

There's no way around that because the whole point of certificates is to warn the user if the website he's visiting has not been certified by a trusted authority.

Answer 2

what were you doing before? For Self-Signed certs, I would normally install the cert locally on the client system.

You may be able to use Group Policy to push a cert to every system.

Answer 3

You Can use GPO to use the cert within the domain.

But my problem is with IE8, that even with the Cert in the trusted root certification store... it still wont say its a trusted site.

with this and the driver signing that needs to be done now... im starting to wonder who owns my computer!!!!

Answer 4

Make sure that your self-signed certificate matches your site url. If it does not, you will continue to get a certificate error even after explicitly trusting the certificate in IE8 (don't have IE 7, but firefox will trust the cert regardless of a url mismatch).

If this is the problem, the red "Certificate Error" box in IE8 will show "Mismatched Address" as the error after you add your cert. Also, "View Certificates" has an Issued to: label which shows what url the cert is valid against.

Answer 5

How to make IE8 trust a self-signed certificate in 20 irritating steps

1. Browse to the site whose certificate you want to trust.
2. When told "There is a problem with this website's security certificate.", choose "Continue to this website (not recommended)."
3. Select Tools->Internet Options.
4. Select Security->Trusted sites->Sites.
5. Confirm the URL matches, and click "Add" then "Close".
6. Close the "Internet Options" dialog box with either "OK" or "Cancel".
7. Refresh the current page.
8. When told "There is a problem with this website's security certificate.", choose "Continue to this website (not recommended)."
9. Click on "Certificate Error" at the right of the address bar and select "View certificates".
10. Click on "Install Certificate...", then in the wizard, click "Next".
11. On the next page select "Place all certificates in the following store".
12. Click "Browse", select "Trusted Root Certification Authorities", and click "OK".
13. Back in the wizard, click "Next", the "Finish".
14. If you get a "Security Warning" message box, click "Yes".
15. Dismiss the message box with "OK".
16. Select Tools->Internet Options.
17. Select Security->Trusted sites->Sites.
18. Select the URL you just added, click "Remove", then "Close".
19. Now shut down all running instances of IE, and start up IE again.
20. The site's certificate should now be trusted.

Answer 6

It's not enough to install the certificate itself, instead you need to install the root certificate of your certification authority. Say if you use Win Server's Certificate Services, its root certificate which was created when CS was installed on that server is the one to be installed. It must be installed to the "Trusted Root Certification Authorities" as described earlier.

Answer 7

It doesn't look like it's possible to not have the certificate error any more. I'm on Windows XP with IE 8. Group Policy had installed a self-signed certificate as a trusted root certificate for access to an internal site. When I look at MMC with the certificate snap-in I can see the certificate there OK.

When I look at:

Internet Options => Content => certificates

It isn't there!

This behaviour in IE started since our admins let loose with the last lot of Patch-Tuesday updates which installed on my machine on 10th Dec 2009. Prior to that it was quite happy to accept the certificate as valid.

Answer 8

Here is how I got it to work in IE8:

1. Go to the website in question, https://xxx.yyy.com, for instance,
2. Click through until you get to the Certificate error in the browser status line.
3. View the cert, then from the Details tab, select Copy to File.
4. Save to the desktop as xxx.cer, for example,
5. Start, Run, MMC.
6. File, Add/Remove Snap-In,
7. Select Certificates, Click Add, My User Account, then Finish, then OK,
8. Dig down to Trust Root Certification Authorities, Certificates,
9. Right-Click Certificate, Select All Tasks, Import,
10. Select the Save Cert from the Desktop
11. Select Place all Certificates in the following Store, Click Browse,
12. Check the Box that says Show Physical Stores, Expand out Trusted Root Certification Authorities, and select Local Computer there, click OK, Complete the Import,
13. Check the list to make sure it shows up. You will probably need to Refresh before you see it. Exit MMC,
14. Open Browser, select Tools, Delete Browsing History
15. Select all but Inprivate Filtering Data, complete,
16. Go to Internet Options, Content Tab, Clear SSL State,
17. Close browser and reopen and test.

Answer 9

I had the same issue while working with web services. Here Microsoft has a (long) walk-thru showing you how to install stuff on the client to basically say that your self-signed cert is ok. In the end, I just spent the $30 and bought a full certificate from Godaddy.com.

P.S. I know that you can code around the error message but we didn't want to do that for testing reasons.

Answer 10

Man, today I've spent a few hours fighting this problem. No matter what I did in the IE 8, the problem remained. The certificate installed by the IE appears in the Trusted Root Certification Authorities of the client PC, however the IE still complains no matter what.

Here's the solution I've discovered:

On the web server:

• Win+R, MMC, Enter.
• File, Add-Remove snap-in, Certificates, Add, Manage certificates for: my user account, Finish, OK.
• Navigate to "Certificates - current user / Trusted Root Certification Authorities / Certificates".
• Find your certificate, right-click, All tasks / Export.
• "No, don't export the private key"
• "DER Encoded binary X.509 (.CER)"
• Save the file somewhere.
• Transfer the newly created .CER file to the client PC.

On the client machine:

• Win+R, MMC, Enter.
• File, Add-Remove snap-in, Certificates, Add, Manage certificates for: my user account, Finish, OK.
• Navigate to "Certificates - current user / Trusted Root Certification Authorities / Certificates".
• Right-click on Certificates container, All tasks / Import
• Choose your .CER file you've transferred from the server machine.
• On the next screen, choose "Place all certificates in the following store", click "Browse", check "Show physical stores", then choose "Trusted Root Certification Authorities / Local Computer".
• Press "Finish" finally.
• In Internet Explorer: Tools - Delete browsing History,
• In Internet Explorer: Tools - Internet options - "Content" tab - Clear SSL state button.

Answer 11

Unfortunately none of the solutions worked for me. I used IE8 on Windows7. When I was looking for a solution, I found the settings about login information in the control panel. So I add under the certificate based information a new entry with the adress of my server and I chose my prefered certificate.

After a clear of the ssl cache in IE8 I just refreshed the site and the right certificate was sent to the server.

This isn't the solution which I wanted but it works.

Answer 12

I got it working like this

1. Start IE with Run as Administrator
2. Browse to server computer using the computer name (ignore certificate warnings)
3. Click the ”Certificate Error” text in the top of the screen and select ”View certificates”
4. In the Certificate dialog, click Install Certificate -> Next
5. Select Place all certificates in the following store -> Browse
6. Check Show Physical Stores check box
7. Select Trusted Root Certificate Authorities – Local Computer
8. Click OK – Next – Finish – Ok
9. Restart IE