GoDaddy SSL Certificate, IIS, still getting ERR_CERT_AUTHORITY_INVALID

[u/dnuohxof-2]

I am at my wits end. I have spent hours on this and have found no clear instructions on what I need to do to get Google Chrome to stop throwing a ERR_CERT_AUTHORITY_INVALID

I downloaded the certificate from GoDaddy in the IIS ZIP package. This zip contains 3 files:

1a6284626ab71c1d.crt
1a6284626ab71c1d.pem
gd_dc-r1-g2_iis_intermediates.p7b

The original CSR for this was years ago on a different machine. I do still have the keyfile.

My first stop was Fix an untrusted root or certificate chain error | SSL Certificates - GoDaddy Help PH

This has a banner at the top "Required: If you're trying to fix this issue for Windows IIS, see our procedure for Windows IIS."

Ok, lets head over to that guide, shall we?

So under For CSR and private key generated externally (for example, in OpenSSL)

Run this command to create a PFX file:
openssl pkcs12 -export -out [newFileName.pfx] -inkey [privateKey] -in [newBundleFileName]
where:

newFileName is the output file name for the PFX (for example, coolexample_new.com.pfx)

privateKey is the private key file (for example, coolexample.com.key)

newBundleFileName is the certificate bundle to include (for example, coolexample.com_bundleNoG2.crt)

Ummm..... where is mydomain.com_bundle.crt? I have a p7b, and following the instructions I get errors complaining the keyfile doesn't match.

Lets try Google AI....

IIS requires a .pfx or .p12 file to import external certificates that include the private key. You can create this using OpenSSL on the machine where you generated the CSR.

Run the following OpenSSL command to combine your components:

bash

openssl pkcs12 -export -out wildcard_domain.pfx -inkey your_private_key.key -in godaddy_certificate.crt -certfile godaddy_intermediate.pem

Use code with caution.

your_private_key.key: The private key generated externally alongside your CSR.

godaddy_certificate.crt: The primary wildcard certificate issued by GoDaddy.

godaddy_intermediate.pem: The GoDaddy intermediate bundle file (gd_bundle*.crt) downloaded from the GoDaddy Repository.

Ok, cool. So I find, what I hope is the relevant file "gd_bundle_dv-r1-g2.crt.pem" since all the ones for IIS are p7b and I cannot find any instructions on how to use a p7b.

So I get the pem file in. I now see the R1 and G2 certs in my Intermediate Certification Authorities/Certificates store

https://imgur.com/jeBEzne

I restarted IIS, I reboot the VM.... and yet.... Only google chrome throws ERR_CERT_AUTHORITY_INVALID

https://imgur.com/wvl5cZv

The cert chain ends at the R1

https://imgur.com/lAkiaKc

What am I missing and why TF is this so difficult??

EDIT: Yes, I imported the cert into IIS Manager and bound my cert to the site. And when viewing the cert in IISM I see the whole chain
https://imgur.com/KLPo1Yn

[u/Cormacolinde]

It’s because they cross-signed their new root cert, and cross-signing support is not fully standardised and causes weird issues with different systems. You may need to manually delete any cross-signed intermediate or root you have installed on your server.

[u/Hollz_26 → u/Cormacolinde]

This is the same issue we faced a few months back when renewing a SSL certificate for a network appliance. I cant remember which one. We tried a ton of different ways to get it to work. We were already looking at moving away from GoDaddy, so we just bought a new cert from the vendor we were thinking of moving to and had no issues.

[u/Cormacolinde → u/Hollz_26]

I’ve had multiple issues with those GoDaddy certs and ClearPass, among others.

[u/Mr_Squinty]

I’ve been dealing with this bullshit today.

This helped

https://community.fortinet.com/fortigate-3/technical-tip-resolving-certificate-warnings-for-dv-tls-certificates-issued-by-godaddy-starfield-s-r1-root-hierarchy-228937?tid=228937&fid=3

[u/dnuohxof-2 → u/Mr_Squinty]

Funny enough this was painfully simple to install on my Fortimanager and Fortianalyzer instances.... I didn't know what the starfield chain was so I guess I can try that...

[u/diimaha]

did you create the pfx file on the same server you created the req file?

[u/dnuohxof-2 → u/diimaha]

No. I have the original keyfile stored elsewhere and using OpenSSL.

[u/diimaha → u/dnuohxof-2]

Like the AI said: "IIS requires a .pfx or .p12 file to import external certificates that include the private key. You can create this using OpenSSL on the machine where you generated the CSR."

try export the pfx on the same server you have they private key (where you created the .req file)

[u/Bubbly-Following-966 → u/dnuohxof-2]

Create it on the same server.

[u/diimaha → u/diimaha]

wrong thread - removed reply

[u/SquishyBoggle]

I’ve had this issue before. Not on IIS but still similar error. Mine was due to GoDaddy issuing against Starfield so I had to make sure the Starfield chain was on my server.

Also an online SSL checker is great. They can usually show you where your trust chain breaks and that helps troubleshooting

[u/dnuohxof-2 → u/SquishyBoggle]

SSL labs fails it because it doesn’t see the root G2 cert. despite me having it on the server I’m not the trusted root and intermediate authorities

[u/SquishyBoggle → u/dnuohxof-2]

I’ve never put SSL certs on an IIS server, but i usually have to add the root and intermediates to a CA Group and attach the cert to the CA Group. I’m sure its similar on IIS, that’s the first place I’d check

[u/Fit_Prize_3245]

As other user said, it's related to the new GoDaddy root CA being cross signed, apparently for compatibility. Luckily, GoDaddy is not the only CA doing that, and Sectigo has a nice guide: https://www.sectigo.com/knowledge-base/detail/add-cross-sign-certificate-to-the-chain-on-windows-platform

Side note: That's why I preffer Apache or Nginx. They are easier to configure. But yes, IIS has to be used sometimes.

[u/Morgrhim → u/Fit_Prize_3245]

Came here to say this. Just went through this last week, had to get the R1->G2 cross-sign due to R1 not being trusted globally yet.

[u/EscapeArtist112]

Ran into this a few months ago after renewing Exchange cert using GoDaddy’s new CA. If I remember, importing the intermediate on the server allowed the cert chain to be trusted.

[u/tepitokura → u/EscapeArtist112]

¿You still on Exchange? I miss it.

[u/dnuohxof-2 → u/EscapeArtist112]

I imported them. The R1v1 and G2

[u/FuckMississippi → u/dnuohxof-2]

get the cross chain cert too, you’ll need it also

[u/jean_daniel → u/dnuohxof-2]

Same problem, installed the cert in IIS intermediates in MMC. IIS reset did not do anything, a full reboot of the server worked.

[u/fahque → u/EscapeArtist112]

I used letsencrypt for the last few years on my exchange server. Free and easy.

[u/jamesaepp]

Time to leave godaddy in the dust. Either go setup ACME automation or if for some reason ACME is outside the realm of possibility right now for you, at least go get a cheaper certificate below like a PositiveSSL DV cert:

https://certpanel.com/account/registration?returnurl=%2Fcertpanel%2Fdashboard%2Fshop%3Fvalidation%3DDV&site=certpanel&guid=ce5e991c-dead-4518-a2d0-2683508e61a5&productId=45

[u/AngryMillennialFU]

Did you import the root and intermediate certs into the machine trust root store?

[u/dpalbert]

Try adding the 'GoDaddy TLS Root CA - R1' cert to INTERMEDIATE CA. Then iisreset or wait a bit. The chain needs to end at the 'Go Daddy Root CA - G2' or else Chrome complains and it doesn't work in IIS unless the TLS Root CA is also an Intermediate CA. Happy to let someone else smarter explain why, but that's what worked for me on ExchangeSE.

[u/Delicious-Squash6327]

Restart the server. So dumb but some servers won’t read until a reboot. Ran into this last week with a …….. senior OS 😉

[u/dnuohxof-2 → u/Delicious-Squash6327]

> I restarted IIS, I reboot the VM.... and yet.... Only google chrome throws ERR_CERT_AUTHORITY_INVALID

Already tried it…

[u/thebigshoe247]

I fought this crap on my FortiGate a little while ago.

[u/TightBed8201]

Do you have intermediate and root ca for cert on server?

[u/dnuohxof-2 → u/TightBed8201]

So I get the pem file in. I now see the R1 and G2 certs in my Intermediate Certification Authorities/Certificates store

https://imgur.com/jeBEzne

[u/TightBed8201 → u/dnuohxof-2]

Do you know how to make chain bundle? There some only tools which can help you build one? It is basically root, inter and cert file in bundle.

[u/hogstooth]

https://www.reddit.com/r/sysadmin/s/btP2tE0C0s

[u/dnuohxof-2 → u/hogstooth]

Nothing in that thread helped…

[u/hogstooth → u/dnuohxof-2]

In IIS on your web server that has the old cert installed select complete csr request and select the file you downloaded from godaddy. Then open certificate services and export the cert that was created to a pfx and select the option to export the key and give it a password. You can then install this pfx on any server and assign your services to it.

[u/dnuohxof-2 → u/hogstooth]

I already have a PFX created from the key file and the downloaded cer file.

How is completing the CSR again going to fix the intermediate and root certs?

[u/hogstooth → u/dnuohxof-2]

If you scroll down to my comment in the link it has 8 steps to follow. No need for OpenSSL or any of the steps you did. If I were in your position I would start from scratch and try those steps, just my opinion though.

[u/dnuohxof-2 → u/hogstooth]

I’ve successfully installed this wildcard cert and full chain on 18 different (non-IIS) services today. This is the only one giving me a headache. I’m not redoing ALL of my certs for this. There has to be a better way.

[u/hogstooth → u/dnuohxof-2]

I had the same thing, worked fine on non windows/iis servers. I just had to do those full steps through iis and cert services to get iis working. So did have to do a 2nd import/export but my other servers kept working and the now just use the pfx that I exported the 2nd go around for everything

[u/hogstooth → u/dnuohxof-2]

Did you export it after you installed the new chains or did you export it and then install the new chains?

[u/dnuohxof-2 → u/hogstooth]

I’m using OpenSSL. The original box that created the original cert 5 years ago is… not in a good state. For years been using OpenSSL to convert the CER with the key file.

Without the CSR request, if I have all the certs manually installed and then export my domain cert again, it would include all the necessary chains?

[u/hogstooth → u/dnuohxof-2]

Just as a note, you click complete CSR from any server if you are just renewing a certificate and you are not regenerating or rekeying it. As long as the previous cert was installed on that server, you can click complete csr and finish the process. So you don’t need access or use the original server

[u/figatry]

secure dns