自 SSL - 证书无效
我今天第一次使用 Self SSL 为我们的交易所 OMA/OWA 创建证书。我已将证书导入到本地计算机上的受信任的根证书颁发机构中，这样就不会提示该证书不是来自受信任的来源。
然而，我仍然收到证书错误“无效证书”，IE8 浏览器栏变为红色并出现安全警告。当我查看证书时，它没有显示任何错误，并说证书很好。
谁能告诉我为什么我会收到此错误？自签名证书是正常的还是证书确实无效？
谢谢
I used Self SSL for the first time today to create a certificate for our exchange-OMA/OWA. I have imported the certificate into trusted root certificate authorities on my local computer so that it will not prompt that the certificate is not from a trusted source.
I am however still getting a certificate error "Invalid Certificate", the IE8 browser bar turns red with a security warning. When I view the certificate it does not display any error and says the certificate is fine.
Can anyone tell me why I am getting this error? is it normal for self signed certificates or is the certificate really invalid some how?
Thank you
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
确保 CN（“通用名称”）属性与您的 URL 和证书中的匹配。例如，如果您使用 CN=localhost 创建证书，但您使用 https://machine 之类的内容在 IE 中访问它.domain.topleveldomain，那么IE会报错machine.domain.topleveldomain与localhost不一样。我相信它会进行字符串比较。
确保证书已安装在本地计算机物理商店下的受信任根证书颁发机构 (TRCA) 中。
如果一切都安装正确，那么还有一种可能性。 Windows 有一个“功能”，可以从 TRCA 中删除不受信任的证书（按照 mircosoft 的说法不受信任）。您可以先禁用此功能，然后重新安装证书。
打开
gpedit.msc并向下钻取计算机配置>管理模板>系统>互联网通讯管理>互联网通讯设置>关闭自动根证书更新。启用关闭自动根证书更新。Microsoft 提供了有关该功能用途的一些详细信息 — 这是一项安全功能，可将您的 TRCA 与 Microsoft 的有效根证书数据库进行比较。
如果关闭该功能后仍然无法工作，则说明您创建该证书的方式存在问题。您可以使用
makecert制作证书。 http://msdn.microsoft.com/en- us/library/bfsktky3(v=vs.80).aspx如果您的计算机的完全限定名称是：machine.domain.com，您可以执行以下操作：
makecert -n "CN=machine.domain.com" c:\file.cer最终您可以通过以下方式访问您的资源： https: //machine.domain.com
希望这有帮助。我也遇到过自签名证书的麻烦。
Make sure that the CN ("Common Name") attribute matches in your URL and certificate. For example, if you created your certificate using the CN=localhost, but you are accessing it in IE using something like https://machine.domain.topleveldomain, then IE will complain that machine.domain.topleveldomain is not the same as localhost. I believe it does a string comparison.
Make sure that the certificate was installed in the Trusted Root Certification Authorities (TRCA) under the Local Computer physical store.
If all is installed correctly, then there is one more possibility. Windows has a "feature" that wipes out untrusted certificates (untrusted according to mircosoft) from the TRCA. You can disable this feature first and then reinstall the certificate.
Open up
gpedit.mscand drill down toComputer Configuration > Administrative Templates > System > Internet Communication Management > Internet Communication Settings > Turn off Automatic Root Certificates Update. EnableTurn off Automatic Root Certificates Update.Microsoft provides some details about what that feature does---its a security feature where your TRCA is compared against microsoft's database of valid root certificates.
If it is still not working after you turn that feature off, then there is a problem with the way in which you created that certificate. You can make a certificate using
makecert. http://msdn.microsoft.com/en-us/library/bfsktky3(v=vs.80).aspxIf your computer's fully qualified name is: machine.domain.com, you can do this:
makecert -n "CN=machine.domain.com" c:\file.cerEventually you can access your resources by: https://machine.domain.com
Hope this helps. I have had my fair share of self-signed certificate woes.