# Security Certificate problem **URL:** \ **Category:** Factual Questions\ **Created:** [July 12, 2004, 8:29pm UTC](https://boards.straightdope.com/t/security-certificate-problem/254765 "2004-07-12T20:29:45Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![ltfire](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@ltfire](https://boards.straightdope.com/u/ltfire)\ **Post date:** [July 12, 2004, 8:29pm UTC](https://boards.straightdope.com/t/security-certificate-problem/254765/1 "2004-07-12T20:29:45Z")
I am running Internet Explorer 5.1 on a Mac. I have numerous sites that I frequent (banks, credit card, personal pension info, not to mention all the sites such as Amazon where I purchase items. Needless to say, these must be secure sites. I was ordering items from a site the other day, and the following message appeared on my screen: UNABLE TO ESTABLISH A SECURE CONNECTION TO (site URL) THERE IS A PROBLEM WITH THE SECURITY CERTIFICATE FROM THAT SITE. THE IDENTITY CERTIFICATE IS UNKNOWN. I called the site on the phone (and I have used this site continuously for the last three years) and was told that I would have to change my security settings. That said, I went to the help file, and read the following: When you visit a secure Web site, the Web site automatically sends Internet Explorer its “certificate.” A certificate guarantees the security of a Web site. Certificates also ensure that no other Web site can assume the identity of the secure site, so you can feel confident that credit card numbers and other personal information you send over the Internet go to the owner of the certificate— and to no one else. That reads to me that the site sends the certificate to my computer, no? I now went to all my other sites, and found the same warning on each and every one of them. I tried the following, I deleted all the certificates and reverted to defaults (the same certificates reappeared) I deleted them again, and with a blank screen, I attempted to access a secure site, in the hopes that the site would send an updated certificate, but, no luck. Where do I go from here? Anybody? . ---
**Author:** ![Astroboy14](https://avatars.discourse-cdn.com/v4/letter/a/df705f/32.png) [@Astroboy14](https://boards.straightdope.com/u/Astroboy14)\ **Post date:** [July 12, 2004, 10:45pm UTC](https://boards.straightdope.com/t/security-certificate-problem/254765/2 "2004-07-12T22:45:36Z")
Did you recently change browsers or something? I find it suspicious that _all_ of the sites you use suddenly are having trouble issuing you valid certificates… A bit of research regarding Macs and security certs yielded [this:](http://www.derkeiler.com/Newsgroups/microsoft.public.inetserver.iis.security/2002-07/2089.html) > [@](#): > > the problem is with the web servers not having the 2011 intermediate ca > installed. In order for a global id to work the browser must have the 2028 > primary root installed and have access to the 2011 intermediate ca. The > intermediate ca can be pre-installed in the browser, OS or provided to the > client by the server during the initial SSL handshake. If the 2011 > intermediate ca is not installed in the browsers or OS a PC browser can > install a new one. However, Mac’s can not install a new intermediate ca. > So, > if the server does not have the 2011 intermediate ca, the Mac browser can > not > make the secure connection. So, either the server needs to install the 2011 > intermediate ca or the client needs to update it’s browser and/or OS to a > version with an embedded 2011 intermediate ca… You might be able to solve the problem by upgrading to a newer version of IE. ---
**Author:** ![beltbuckle](https://avatars.discourse-cdn.com/v4/letter/b/3da27b/32.png) [@beltbuckle](https://boards.straightdope.com/u/beltbuckle)\ **Post date:** [July 12, 2004, 10:55pm UTC](https://boards.straightdope.com/t/security-certificate-problem/254765/3 "2004-07-12T22:55:04Z")
Security Certificates can be a real pain, if you have ever set one up, you know this. Here’s the basics of the problem: Ceritificates are granted by different companies (Verisign, Entrst, Geotrust, Comodo, etc). It is these grantors’ responsibility to verify your company is who you say it is, and things like address, credit card info, and other information is used to validate this. When you purchase a SSL certificate, they have effectively verified your company. The problem arises in that the web browser ships with a specific list of certificate providers that the browser trusts. So if you are using an old Windows 95 system, and never updated your browser, any new SSL provider that has come along since will not be automatically trusted. Newer browsers, in general, trust more certificate authors. So every SSL provider works with a certain percentage of web browsers. Most work with around 99% of web browsers, but it is very hard to be trusted by every browser known to man.