1

My webhost has installed an SSL certificate for my website. When I navigate to the website, it complains about not being secure. The error shown is This CA Root certificate is not trusted because it is not in the Trusted Root Certification Authorities store.

It sounds to me that this is not a problem with the certificate itself, but rather, a problem of incorrect configuration. The information that authenticates this certificate isn't in all the places it needs to be.

I presume that means on the server, but I'm not 100% sure. Where is this store? Thanks in advance.

/************************** EDIT ********************************************/

To Patrick Mevzek, thank you. I'm looking for the kind of SSL that doesn't require the user to do anything extra. For example, I don't know how to import the correct CA to the correct store in my browser, and the idea of importing anything from a site that my browser tells me it isn't secure doesn't sound so appealing.

In response to Stephen Ostermiller's comments: Thank you too. You can visit the site yourself, if that helps: mens.tysonscup.com I got the certificate from ZeroSSL, but I don't see that mentioned anywhere.

I'll also add this: https://globalsign.ssllabs.com/analyze.html?d=mens.tysonscup.com

enter image description here

enter image description here

enter image description here

Improve this question
2
  • 1
    Can you give us more information about the certificate? If you click on the padlock (or broken padlock) in your browser, there should be some way to "view certificate." That will tell you which certificate authority issued it along with other information. You could edit the question to include a screenshot or copy and paste some of that text. That would help us answer this question for you.
    – Stephen Ostermiller ♦
    Commented Jun 29, 2020 at 23:56
  • 1
    "Where is this store?" There isn't a single one. Typically the OS has one, and then each browser has its own (with sometimes configuration to let it also use the OS one, like Firefox does). Each application can have its own one too. The error message you get will find a solution by importing the correct CA in the correct truststore on the client, there is not thing to do on the server.
    – Patrick Mevzek
    Commented Jun 30, 2020 at 3:20

1 Answer 1

Reset to default
0

Your certificate is invalid because it is self signed. Firefox gives me the following information about your certificate when I visit your site:

To understand this error it helps to have a little background about the purpose of SSL certificates. When you get a certificate, you get it from a certificate authority that verifies, at a minimum, that you have control over the domain name. Browsers have a list of certificate authorities that they trust. Browsers call this list their "Trusted Root Certification Authorities".

It is also possible to sign a certificate yourself. However browsers won't trust a self-signed certificate. Anybody can self-sign a certificate for any domain. With a self-signed certificate there can be no guarantee that website isn't impersonating the real website.

If you want your web browser to trust your self-signed certificate, you can do that. You just have to click passed the browser warnings (probably through advanced options), and click to trust the certificate. However, that won't help get your site up and running for HTTPS for everybody. To get HTTPS running on your site, you will need to a certificate that is signed by a certificate authority that is trusted by all web browsers.

ZeroSSL has a tool to generate self-signed certificates. It appears that is what you used. When you got the self-signed certificate, they didn't make it clear to you that it wouldn't let users onto your website over HTTPS.

ZeroSSL also has the ability to generate certificates that should work for you through the Acme protocol. That is usually done through software called certbot. I've never used ZeroSSL myself, but you might be able to get a usable certificate from them.

The more common way of getting free certificates is to use Let's Encrypt. They also use the Acme protocol though certbot and provide certificates for 80% of all secure websites. Let's Encrypt is easiest to use if your web host supports it. Many hosting companies allow you to press a button to get a certificate to secure your site from Let's Encrypt.

Improve this answer
1
  • Thanks, your comment made me go read their website more carefully, and you are spot on with your observation. I appreciate the answer, thanks again.
    – George Alvarez
    Commented Jun 30, 2020 at 19:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.