SSL Certificate trusted on one machine, not another

Question

I have an SSL certificate (from Verisign) installed on a web service. If I access this from my own machine (and a number of client machines in the office), it is verified, trusted and happy. If I access it from one server, it is trusted but from another one it is not.

Obviously, the one that doesn't trust it is one that needs to communicate with that web service.

What's gone wrong here? I don't know too much about SSL (the certificates were installed by another team), so I don't totally get what the Verisign site is saying about installation, or if I should even be looking at it.

EDIT: I've installed a Verisign root certificate on the server now, since this was not there before. It's showing the web service as trusted from IE on the server, but the application (hosted in IIS) that is supposed to talk to the web service still cannot communicate. We have scheduled in an IIS restart later today, to see if that resolves it. Any other advice is appreciated!

Solution 1

Check to see if the correct root certificate is on the affected server. Copy it from another machine if necessary.

Solution 2

There are two reasons I can think of that a client would not recognize a valid certificate: one is that the client is using an old browser or outdated root certificates. Second, the certificate requires a SSLCertificateChainFile to validate against an intermediate certificate. A lot of the SSL vendors are using Intermediate certificates it seems, rather than signing issued certs directly with their root certs. If the team that installed the cert did not install the intermediate cert, this could cause the problem. I saw this recently with a RapidSSL cert where the intermediate certificate was required for Android devices, but Firefox/Safari/IE all worked fine.

Comments

[orangephoenix]

Browser will tell you what is wrong. Also this excelent online tool will test your SSL and reveal possible problem: ssllabs.com

[pete the pagan-gerbil]

@John Gardeniers: This was the exact solution. The certificate I installed fixed it in IE, but not other apps, but copying it from another machine worked perfectly. If you'd put this as an answer rather than a comment I'd accept it!

[mathtick]

Assume you are just a client. Is this still relevant?