The identity of this website has not been verified for openssl

Question

I am new to ssl cerifications. I have installed openssl certificate for my exchange server because I don't want to pay to certificate. It is working fine on the server and local network. But when I tried outside the network. I am still getting ssl error on chrome and IE browsers like showing below.

I don't know openssl works outside the network or not? if not why openssl use of it?. Or I am missing something?

Solution

This has nothing to do with openssl but is because how SSL/TLS work.

A certificate is like an identification document signed by a trusted entity (like a government). The browsers and operating systems get shipped with a set of trusted entities, the "root CA (certificate agency)". Since your certificate is not signed by any of the built-in trusted entities the browser refuses to trust it and you get this error message. This trust check is essential when validating the certificate. If it would not be done anybody could claim your identity and thus hijack the encrypted connection (man-in-the-middle attack).

So your only options are either to get a certificate from a trusted entity or to add yourself as a trusted entity into each browser and operating system which should be able to access your site. Of course this can only be done for endpoints you control.

Comments

[jww]

"...but is because how SSL/TLS work." - its due to the Browsers enforcing CA/B Forum polices, and not SSL/TLS.

[Steffen Ullrich]

I think the different roles of the various SSL/TLS standards, the rules of CA/B Browser forum and there interpretation by CA and browsers is way too much detail for somebody which is new to certificates. And the knowledge of this is not even needed to understand the issue. Also, the main aspect of this sentence was to point out that is has nothing to do with openssl.