Public Certificates from ‘Newer’ Trusted Root Certificate Authorities

Recently we went live with a secure site which was secured using a public certificate issues by a Root Certificate Authority.

During User Acceptance Testing we found that some clients were showing a browser error stating that the certificate had been issued by an untrusted source.

On investigating the issue we found that the Root Certificate Authority which had issued the certificate was not published as a Trusted Root Certificate Authority in the Certificates MMC Snap-In on the clients showing the error. A little further investigation uncovered that the authority in question had only been added to the list in the last twelve months.

The issue was resolved by running Windows updates on the client machines… which had not been done for some time! Two of the Windows Updates amended the Trusted Root Certificate Authority list and once the clients were restarted the certificate warning went away.

Two lessons:

1. Always run your Windows Updates.

2. Choose an authority that has been on the list for a longer period of time.

C

IIS 7.5 Redirect HTTP to HTTPS

Recently we deployed a secure website that needed to automatically redirect HTTP traffic to HTTPS. This is quite easy to do if the site is published using Microsoft ISA / TMG but as this was a hosted product on a third party Firewall we needed to do the redirect using IIS only.

The site was running on IIS 7.5 and we performed the following steps:

1. Open the IIS Management Console, Click on the site in question and then double-click on SSL settings.

 

2. Tick the ‘Require SSL’ Box

3. Go back to the IIS Management Console and double-click on the IIS Error Pages icon. Not the .Net Error pages… as shown in the screen clipping below.

4. Double-Click the 403 error and in the dialog box that opens select respond with a 302 redirect and then enter the https://urlname that it needs to redirect to.

5. Click OK and your HTTP site will now automatically redirect to HTTPS

C