Verification of the Certificate Failed. Please Install a Valid Certificate and Try Again.
Editor's Note: This blog was originally posted in September of 2016. It has been reviewed for clarity and accurateness by GlobalSign Production Manager Sebastian Schulz and updated accordingly.
Sometimes, even PKI veterans struggle with ordering or installing SSL/TLS certificates. This does not suggest a lack of knowledge – rather, those processes tin can bring up previously unseen errors. Ordering the right certificate, creating a CSR, downloading information technology, installing information technology, and testing information technology to make sure there are no problems are all areas where one may come across errors.
We want to assist make the process as simple as possible from commencement to finish. For that reason, we collated our height queries and issues that customers may face during ordering or installation. We hope this blog will assist y'all avoid those pitfalls and streamline your time to completion, merely if yous have a problem that you cannot solve using this blog you tin can still check out the GlobalSign Support Noesis Base or submit a ticket.
Choosing the Correct Approval Method
There are three ways to have your domain verified with the states: approver email, HTTP verification, and DNS TXT record. And if at some signal yous grow tired of verifying domains every fourth dimension you society a certificate, why not give Managed SSL a try?
Notation: When ordering an SSL Certificate from our organisation, blessing methods cannot be changed once chosen.
Approver E-mail
When placing an order, y'all can cull from the following e-mail addresses to allow u.s.a. to verify your domain:
- admin@domain.com
- administrator@domain.com
- hostmaster@domain.com
- postmaster@domain.com
- webmaster@domain.com
An email volition exist sent to the selected address and upon receipt of the email you can click a link to verify the domain is yours.
Note: Make sure you lot choose the right one, or you will have to cancel the lodge and showtime a new social club.
If you do not accept access or cannot fix up an electronic mail from the above list, you volition need to contact Back up who will guide you through other possible options for e-mail verification. These are:
- Updating the WHOIS records with an email address (an case of a website GlobalSign uses to cheque Who is records is networksolutions.com).
- Creating a page on the website of the domain using instructions from our support team. This will indicate control of the domain and allow the vetting team to transport the approving e-mail to ANY alternative email address.
NOTE: A dedicated back up article guiding you through domain verification by approver email tin can be found here.
HTTP Verification
Using the HTTP Verification (also called Approver URL- or meta tag-) method, y'all tin insert a random cord provided by GlobalSign in the root page of your domain (for instance domain.com). The directory chosen for this must be domain.com/well-known/pki-validation/gsdv.txt
Our verification system will be able to detect the meta tag on the page and verify the domain ownership. Nonetheless, our system cannot verify the domain if it redirects to some other page and so make certain to disable all redirects.
Note: A dedicated back up article guiding you through domain verification by HTTP verification tin can be found here.
DNS TXT Record
DNS TXT records entail implementing a code into the DNS TXT of the registered domain. You need to make sure the string exactly matches what you were provided at the stop of ordering your certificate or from our vetting squad. Also, you need to brand sure that the record is publicly accessible. You can use some costless online tools to check your DNS TXT records. Alternatively, you can run a command in command prompt to come across if at that place is a txt entry, for example: nslookup -type=txt domain.com
Note: A dedicated support article guiding you through domain verification by DNS TXT record can be institute here.
Private Key Missing
Ordering an SSL/TLS certificate requires the submission of a CSR and in social club to create a CSR a private cardinal has to be created. Your private key matching your certificate is usually located in the same directory the CSR was created. If the private key is no longer stored on your machine (lost) then the document volition need to exist reissued with a new CSR and therefore also a newly created individual central.
Examples of error letters/situations which would indicate there is no private fundamental:
- 'Private key missing' error message appears during installation
- 'Bad tag value' mistake message appears during installation
- After importing the certificate into IIS, the certificate disappears from the list when refreshed
- When going onto your website, the site does not load in https://
No thing how convenient information technology seems, we want to discourage the employ of online tools to generate CSRs. Those volition also have your private cardinal, meaning the security of your server may be compromised in the hereafter.
Note: We offer many guides to help you generate private keys and CSRs.
SAN Compatibility
With a discipline culling name or SAN certificate, there are several things to note earlier ordering:
- UCC (Unified Communication) SANs tin be selected for gratuitous. Those embrace some direct subdomains of the Common Name (for example, domain.com):
- mail.domain.com
- owa.domain.com
- autodiscover.domain.com
- www.domain.com
- Subdomain SANs are applicable to all host names extending the Common Name by one level. For instance:
- back up.domain.com could be a Subdomain SAN for a certificate with the Common Proper noun domain.com
- avant-garde.back up.domain.com could NOT be covered by a Subdomain SAN in a certificate issued to domain.com, as information technology is not a directly subdomain of domain.com
- FQDN (Fully Qualified Domain Name) SANs are applicable to all fully qualified host names, unrelated to the Common Name
- support-domain.internet could exist a FQDN SAN in a document with the Common Name domain.com
- support.domain.com would also be a valid FQDN for a certificate with Common Name domain.com, but roofing this selection with a Subdomain SAN is the smarter pick
- IP Addresses can not be covered past FQDN SANs
- SANs for Public IP Addresses will only work for registered and public Global IP Addresses, otherwise ownership cannot be verified
- Wildcard SANs work the aforementioned manner as FQDN SANs but volition cover an entire subdomain level, no matter what stands for the asterisk
- For instance, the Wildcard SAN *.domain.com will encompass back up.domain.com, gcc.domain.com, mail.domain.com – and so on!
For the compatibility of the different SAN Types with different products, delight see the table below:
It is also possible to remove a SAN after your document has been issued.
Invalid CSR
If you are creating a renewal CSR, then you will need to ensure the Common Proper name matches the ane of your original CSR. The new CSR volition not exist the same since the private central must be different. You may not use the same CSR again, even if it seems convenient.
You tin can test a CSR by using the decoder in the Managed SSL Tab of your GlobalSign accounts. Should you not have that available, you can safely use online resources to check your CSR, every bit long as you exercise not share your private central you do not have to be concerned for their security. If in that location are any actress spaces or too many or too few dashes at the outset/end of the certificate request, it will invalidate the CSR.
-----Begin CERTIFICATE REQUEST-----
-----Stop CERTIFICATE REQUEST-----
The Common Proper name Y'all Have Entered Does Non Match the Base Pick
This error appears when y'all are ordering a Wildcard SSL Certificate but accept not included the asterisk in the Common Name of the CSR (e.thousand. a CSR with CN domain.com, rather than*.domain.com). Or if conversely, you take entered *.domain.com with the CSR and not selected that you wish to order a Wildcard certificate.
As earlier explained, the [*] represents all sub-domains you tin can secure with this type of document. For instance, if you desire to secure www.domain.com, mail service.domain.com and secure.domain.com, you volition need to enter *.domain.com equally the Common Proper noun in the CSR.
Note: You lot cannot create a Wildcard with a sub-domain earlier the asterisk, e.chiliad. mail.*.domain.com, or double Wildcards, such every bit *.*.domain.com.
Key Duplicate Error
This error appears when y'all are using a private key which has already been used. A private key and CSR must only be used Once.
You lot should generate a new private key and CSR on your server and re-submit the new CSR. The reason SSL/TLS certificates take a maximum validity (and this one being cut curt repeatedly) is an effort to ensure that keys are exchanged frequently, therefore mitigating the risk of undetected compromise.
Order Land Has Already Been Inverse
This fault message generally appears when your order has timed out. You should outset the ordering process from scratch and to let us know if the upshot persists. If it does, we need to run further checks on your account.
NOTE: this error message can also be caused past wrongly specified SANs. For case, if the CN is "www.domain.com" and you specified sub-domain as "domain.domain2.com" which specifies a dissever FQDN. Bank check the data about SANs to a higher place for clarification.
The SANs Options You Have Entered Do Not Match the SAN Options on the Original Certificate
This problem can occur for several reasons:
- You added a space before or after the SAN.
- There is a typo in the information you have provided.
- You are entering the Common Proper name (CN) of the certificate as a SAN. Following regulations, nosotros will always add your Common Name as a SAN, this does not need to be specified.
- You lot incorrectly enter the SAN as a sub-domain, multi-domain name, internal SAN or IP. You need to cull the right blazon of SAN which applies to the SAN. Please also check the above information on unlike SANs.
Certificate Not Trusted in Spider web Browser
After installing the certificate, you may still receive untrusted errors in certain browsers. This happens when the intermediate certificate has not been installed or for some reason the GlobalSign Root Document is missing from the client connecting to your server. Unless the client has been heavily tampered with, this should not occur – our Root Certificates are embedded in nigh all modernistic operating systems and applications.
Running a health cheque on the domain volition place missing intermediate certificates. If the intermediate certificate is missing, use the following link to determine which intermediate is needed based on production type (DomainSSL, OrganisationSSL, ExtendedSSL, AlphaSSL etc).
Findout more about intermediate certificates and why we use them.
'Switch From Competitor' Error Message
When choosing the 'switch from competitor' pick in our certificate ordering organization, y'all may see the following error bulletin:
The server hosting your existing certificate cannot exist reached to confirm its validity. Please obtain a copy of your existing certificate and paste it in the box below. All competitive switches are subject to review past GlobalSign'southward vetting squad against the trusted issuers in the browser trust stores. If your certificate is not issued past a valid root CA Certificate, it will be subject field to cancellation and/or revocation.
This error message occurs when your current certificate is no longer valid. You lot should simply choose this option if you are switching before your document with another visitor expires.
This mistake message could also occur if your current document is not installed on the domain. Our system volition not be able to detect the validity in this case so y'all should untick this option and become through the normal ordering process.
If you have a valid document from a competitor that is not installed on the server then you can paste your CSR into the text box using the 'Switch from Competitor' option. Meet the beneath image.
Finally, this error message could show when you have installed a certificate on your server but the CN is not the same as the domain name. For example, this tin happen with a SAN document. In this case, simply untick 'switch from a competitor' and get through the normal ordering process.
If you are switching over to GlobalSign that'south great! If you think you should be eligible for xxx days of free validity but if yous cannot go through with the process just contact us and a team member will reach out to you lot.
For more assistance with general SSL Certificate queries then visit the General SSL folio on our support site.
Source: https://www.globalsign.com/en/blog/top-ssl-certificate-errors-and-solutions
0 Response to "Verification of the Certificate Failed. Please Install a Valid Certificate and Try Again."
Post a Comment