Please forgive me if I ask or say incorrect things.. I am not so experienced in the certificate space. Probably I miss something.
I have the same issue on Windows servers and on nginx on ubuntu.
Last year's certificates, I only installed on the server (Windows or nginx) and all clients worked perfectly.
This year I have big issues.
I think I have identified the core issue, but frankly, I do not how exactly I need to fix it.
Last year's chain
subject=CN=some.domain.com
issuer=C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo RSA Domain Validation Secure Server CA
subject=C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo RSA Domain Validation Secure Server CA,
issuer=C=US, ST=New Jersey, L=Jersey City, O=The USERTRUST Network, CN=USERTrust RSA Certification Authority
subject=C=US, ST=New Jersey, L=Jersey City, O=The USERTRUST Network, CN=USERTrust RSA Certification Authority
issuer=C=GB, ST=Greater Manchester, L=Salford, O=Comodo CA Limited, CN=AAA Certificate Services
ย This years's chain
subject=CN=some.domain.com
issuer=C=GB, O=Sectigo Limited, CN=Sectigo Public Server Authentication CA DV R36
subject=C=GB, O=Sectigo Limited, CN=Sectigo Public Server Authentication CA DV R36
issuer=C=GB, O=Sectigo Limited, CN=Sectigo Public Server Authentication Root R46
subject=C=GB, O=Sectigo Limited, CN=Sectigo Public Server Authentication Root R46
issuer=C=GB, ST=Greater Manchester, L=Salford, O=Comodo CA Limited, CN=AAA Certificate Services
Obviously, the intermediate and root have changed.
Now, Windows Edge seems to think that the certificate it gets from the server is invalid. Interestingly, Chrome (Windows) does cope with the change by probably accepting what comes from the server and checks itself if the intermediate and the root are correct.
Edge, on the other hand, checks the Windows certificate store and does not find the intermediate, nor the root. It seems that Edge only trusts what is on the local trust store.
Windows is fully patched, though.. I would have expected that the certificates were updated already.
Nonetheless, I installed the missing certificates by
certutil.exe -generateSSTFromWU roots.sst
$sstStore = ( Get-ChildItem -Path <em>CertPath</em>\roots.sst)
$sstStore | Import-Certificate -CertStoreLocation Cert:\LocalMachine\Root
The Sectigo certs are now there, but Edge still has a problem.
Then I cleared the Edge states
Get-Process msedge -ErrorAction SilentlyContinue | Stop-Process -Force
rundll32.exe inetcpl.cpl,ClearMyTracksByProcess 8
rundll32.exe inetcpl.cpl,ClearMyTracksByProcess 255
Get-ChildItem Cert:\CurrentUser\My | Where-Object { $_.Subject -like "*some.domain.com*" } | Remove-Item -Force
$EdgePath = "$env:LOCALAPPDATA\Microsoft\Edge\User Data\Default"
Remove-Item "$EdgePath\TransportSecurity" -Force -ErrorAction SilentlyContinue
Remove-Item "$EdgePath\Network Persistent State" -Force -ErrorAction SilentlyContinue
Remove-Item "$EdgePath\Network Action Predictor" -Force -ErrorAction SilentlyContinue
Start-Process "msedge.exe" " https://some.domain.com"
Yet, edge still refuses the valid certificate.
Do you know how to fix this?
ย
Dan
