What do I need to do to get Internet Explorer 8 to accept a self signed certificate?

Make sure that your self-signed certificate matches your site URL. If it does not, you will continue to get a certificate error even after explicitly trusting the certificate in Internet Explorer 8 (I don't have Internet Explorer 7, but Firefox will trust the certificate regardless of a URL mismatch).

If this is the problem, the red "Certificate Error" box in Internet Explorer 8 will show "Mismatched Address" as the error after you add your certificate. Also, "View Certificates" has an Issued to: label which shows what URL the certificate is valid against.

Man, today I've spent a few hours fighting this problem. No matter what I did in the IE 8, the problem remained. The certificate installed by the IE appears in the Trusted Root Certification Authorities of the client PC, however the IE still complains no matter what.

Here's the solution I've discovered:

On the web server:

• Win+R, MMC, Enter.
• File, Add-Remove snap-in, Certificates, Add, Manage certificates for: my user account, Finish, OK.
• Navigate to "Certificates - current user / Trusted Root Certification Authorities / Certificates".
• Find your certificate, right-click, All tasks / Export.
• "No, don't export the private key"
• "DER Encoded binary X.509 (.CER)"
• Save the file somewhere.
• Transfer the newly created .CER file to the client PC.

On the client machine:

• Win+R, MMC, Enter.
• File, Add-Remove snap-in, Certificates, Add, Manage certificates for: my user account, Finish, OK.
• Navigate to "Certificates - current user / Trusted Root Certification Authorities / Certificates".
• Right-click on Certificates container, All tasks / Import
• Choose your .CER file you've transferred from the server machine.
• On the next screen, choose "Place all certificates in the following store", click "Browse", check "Show physical stores", then choose "Trusted Root Certification Authorities / Local Computer".
• Press "Finish" finally.
• In Internet Explorer: Tools - Delete browsing History,
• In Internet Explorer: Tools - Internet options - "Content" tab - Clear SSL state button.

Here is how I got it to work in IE8:

1. Go to the website in question, https://xxx.yyy.com, for instance,
2. Click through until you get to the Certificate error in the browser status line.
3. View the cert, then from the Details tab, select Copy to File.
4. Save to the desktop as xxx.cer, for example,
5. Start, Run, MMC.
6. File, Add/Remove Snap-In,
7. Select Certificates, Click Add, My User Account, then Finish, then OK,
8. Dig down to Trust Root Certification Authorities, Certificates,
9. Right-Click Certificate, Select All Tasks, Import,
10. Select the Save Cert from the Desktop
11. Select Place all Certificates in the following Store, Click Browse,
12. Check the Box that says Show Physical Stores, Expand out Trusted Root Certification Authorities, and select Local Computer there, click OK, Complete the Import,
13. Check the list to make sure it shows up. You will probably need to Refresh before you see it. Exit MMC,
14. Open Browser, select Tools, Delete Browsing History
15. Select all but Inprivate Filtering Data, complete,
16. Go to Internet Options, Content Tab, Clear SSL State,
17. Close browser and reopen and test.

You should install your certificate as a trusted authority on your computer.

There are numerous way to do that, for exampe you could use mmc (start/run/mmc), add the Certificates Snap-In, and from there you can install your self-signed certificate.

There's no way around that because the whole point of certificates is to warn the user if the website he's visiting has not been certified by a trusted authority.

You can use GPO to use the certificate within the domain.

But my problem is with Internet Explorer 8, that even with the certificate in the trusted root certification store... it still won't say it's a trusted site.

With this and the driver signing that needs to be done now... I'm starting to wonder who owns my computer!

Unfortunately none of the solutions worked for me. I used Internet Explorer 8 on Windows 7. When I was looking for a solution, I found the settings about login information in the control panel. So I added a new entry under the certificate based information with the address of my server and I chose my prefered certificate.

After a clear of the SSL cache in Internet Explorer 8 I just refreshed the site and the right certificate was sent to the server.

This isn't the solution which I wanted, but it works.

What were you doing before? For self-signed certificates, I would normally install the certificate locally on the client system.

You may be able to use Group Policy to push a certificate to every system.

It doesn't look like it's possible to not have the certificate error any more. I'm on Windows XP with IE 8. Group Policy had installed a self-signed certificate as a trusted root certificate for access to an internal site. When I look at MMC with the certificate snap-in I can see the certificate there OK.

When I look at:

Internet Options => Content => certificates

It isn't there!

This behaviour in IE started since our admins let loose with the last lot of Patch-Tuesday updates which installed on my machine on 10th Dec 2009. Prior to that it was quite happy to accept the certificate as valid.

I had the same issue while working with web services. Here Microsoft has a (long) walk-thru showing you how to install stuff on the client to basically say that your self-signed cert is ok. In the end, I just spent the $30 and bought a full certificate from Godaddy.com.

P.S. I know that you can code around the error message but we didn't want to do that for testing reasons.

How to install the CA Root Cert, and not the Website Cert: (IE8, Win7)

When you bring up the certificate details you are looking at the website cert, and not the CA cert. The General tab will say, "This certificate cannot be verified..." You need to select the CA by clicking on the Certification Path tab, and selecting the top most cert in the path. It should have a red X icon, and should say, "This CA Root certificate is not trusted because..." Click the View Certificate button, and on this new General tab you should see, "This CA Root is not trusted..." This is the certificate that you want to import into the Trusted Root Certificate Authority.

Once you have imported the CA, you do not need to import the regular website cert. That cert will get matched up to the CA you just imported, and IE will treat everything as working normally. You do not need to run IE as Admin, and you do not need to add the site to trusted sites first. You do need to restart IE after the import.