24/1/2014

GeoTrust Cross Root Install on Windows Servers

GeoTrust Cross Root Install on Windows Servers Problem:

Your Android mobile device returns this error when attempting to establish a secure connection with Android Mobile phones prior to version 2.2 "This certificate is not from a trusted authority"

Cause:
Android mobile phones that are pre version 2.2 appear to only contain a limited number of CA root certificates for VeriSign, Thawte and GeoTrust.

Resolution:
Google is aware of this issue for Android mobile devices (pre 2.2 version) with limited number of CA root certificates for VeriSign, Thawte and GeoTrust. According to Google's forum, additional VeriSign, Thawte and GeoTrust roots will be included in a future release of the Android OS. GeoTrust offers a cross root ca that is available below. The GeoTrust cross root cert allows your issued SSL server certificate to chain up to the old "Equifax Secure Certificate Authority" root which is already included in Android OS mobile devices. To resolve this issue on mobile devices, perform the following steps.

Step 1: Obtain GeoTrust Cross Root CA

1. Copy the GeoTrust Cross Root below and past it into a text editor such as notepad. DO NOT use Microsoft Word 2. B E G I NC E R T I F I C A T E M I I D f T C C A u a g A w I B A g I D E r v m M A 0 G C S q G S I b 3 D Q E B B Q U A M E 4 x C z A J B g N V B A Y T A l V T M R A w D g Y D V Q Q K E w d F c X V p Z m F 4 M S 0 w K w Y D V Q Q L E y R F c X V p Z m F 4 I F N l Y 3 V y Z S B D Z X J 0 a W Z p Y 2 F 0 Z S B B d X R o b 3 J p d H k w H h c N M D I w N T I x M D Q w M D A w W h c N M T g w O D I x M D Q w M D A w W j B C M Q s w C Q Y D V Q Q G E w J V U z E W M B Q G A 1 U E C h M N R 2 V v V H J 1 c 3 Q g S W 5 j L j E b M B k G A 1 U E A x M S R 2 V v V H J 1 c 3 Q g R 2 x v Y m F s I E N B M I I B I j A N B g k q h k i G 9 w 0 B A Q E F A A O C A Q 8 A M I I B C g K C A Q E A 2 s w Y Y z D 9 9 B c j G l Z + W 9 8 8 b D j k c b d 4 k d S 8 o d h M + K h D t g P p T S E H C I j a W C 9 m O S m 9 B X i L n T j o B b d q f n G k 5 s R g p r D v g O S J K A + e J d b t g / O t p p H H m M l C G D U U n a 2 Y R p I u T 8 r x h 0 P B F p V X L V D v i S 2 A e l e t 8 u 5 f a 9 I A j b k U + B Q V N d n A R q N 7 c s i R v 8 l V K 8 3 Q l z 6 c J m T M 3 8 6 D G X H K T u b U 1 X u p G c 1 V 3 s j s 0 l 4 4 U + V c T 4 w t / l A j N v x m 5 s u O p D k Z A L e V A j m R C w 7 + O C 7 R H Q W a 9 k 0 + b w 8 H H a 8 s H o 9 g O e L 6 N l M T O d R e J i v b P a g U v T L r G A M o U g R x 5 a s z P e E 4 u w c 2 h G K c e e o W M P R f w C v o c W v k + Q I D A Q A B o 4 H w M I H t M B 8 G A 1 U d I w Q Y M B a A F E j m a P k r 0 r K V 1 0 f Y I y A Q T z O Y k J / U M B 0 G A 1 U d D g Q W B B T A e p h o j Y n 7 q w V k D B F 9 q n 1 l u M r M T j A P B g N V H R M B A f 8 E B T A D A Q H / M A 4 G A 1 U d D w E B / w Q E A w I B B j A 6 B g N V H R 8 E M z A x M C + g L a A r h i l o d H R w O i 8 v Y 3 J s L m d l b 3 R y d X N 0 L m N v b S 9 j c m x z L 3 N l Y 3 V y Z W N h L m N y b D B O B g N V H S A E R z B F M E M G B F U d I A A w O z A 5 B g g r B g E F B Q c C A R Y t a H R 0 c H M 6 L y 9 3 d 3 c u Z 2 V v d H J 1 c 3 Q u Y 2 9 t L 3 J l c 2 9 1 c m N l c y 9 y Z X B v c 2 l 0 b 3 J 5 M A 0 G C S q G S I b 3 D Q E B B Q U A A 4 G B A H b h E m 5 O S x Y S h j A G s o E I z / A I x 8 d x f m b u w u 3 U O x / / 8 P D I T t Z D O L C 5 M H 0 Y 0 F W D o m r L N h G c 6 E h m o 2 1 / u B P U R / 6 L W l x z / K 7 Z G z I Z O K u X N B S q l t L r o x w U C E m 2 u + W R 7 4 M 2 6 x 1 W b 8 r a v H N j k O R / e z 4 i y z 0 H 7 V 8 4 d J z j A 1 B O o a + Y 7 m H y h D 8 S https://www.geocerts.com/support/cross_root

1/5

24/1/2014

GeoTrust Cross Root Install on Windows Servers b 8 r a v H N j k O R / e z 4 i y z 0 H 7 V 8 4 d J z j A 1 B O o a + Y 7 m H y h D 8 S E N DC E R T I F I C A T E -

3. Save the file as Cross_Root.cer on your server in a location you can remember.

Step 2: Adding the Certificates Snap-in MMC:

If you do not have Certificates snap-in installed in your server's Microsoft Management Console (MMC), you'll need to install it before proceeding. Follow the instructions here to install the Certificates snap-in in the MMC.

Step 3: Install the GeoTrust Cross Root CA Certificate

For Microsoft IIS 5.0, 6.0 and 7.0 1. Using the Console, double-click on Intermediate Certification Authorities from the right pane 2. Right-click on Certificates from the right pane and select All Tasks > Import to open the Certificate Import Wizard

Multi-domain SSL. It's Here!

3. Click Next 4. Specify the location of theCross_Root.crt file obtained from Step 1 by
https://www.geocerts.com/support/cross_root 2/5

24/1/2014

4. Specify the location of theCross_Root.crt file obtained from Step 1 by clicking Browse 5. Click Next 6. By default, it will place the certificate in the Intermediate Certification Authorities store. Keep this selection and click on the Next button. 7. Click Finish 8. A message will appear confirming the successful import of the certificate. Click OK 9. Keep the Console open Our Customers

GeoTrust Cross Root Install on Windows Servers

(see more)

Step 4: Check for and Disable the GeoTrust Global CA

1. Using the open Console, expand the Trusted Root Certification Authorities folder on the left and select the Certificates sub-folder. 2. Locate the following certificate: Issued to: GeoTrust Global CA Issued by: GeoTrust Global CA Valid from: 5/20/2002 to 5/20/2022 Serial number: 02 34 56

3. If this certificate is present, it must be disabled. Right click the certificate, select Properties. 4. In the Certificate purposes section, select Disable all purposes for this certificate, then click OK

https://www.geocerts.com/support/cross_root

3/5

24/1/2014

GeoTrust Cross Root Install on Windows Servers

5. Close MMC - there is no need to save console settings. 6. Once this is done restart your IIS service and the error message should be resolved when you access your website. Note: In some cases the changes may not take place after restarting IIS Services and a re-boot is needed.

Step 5: Verify certificate installation

1. Stop and start your Web server prior to any testing Note: In some cases the changes may not take place after restarting IIS Services and a re-boot is needed. 2. To verify the SSL certificate installation, use the GeoCerts Certificate Checker Note: There are times when even if the intermediate certificates are installed correctly and in the correctly certificates store, yet the Microsoft IIS Servers still are not sending the correct chaining to the client. If so, export the certificate from the MMC, personal store as a .pfx file. Choose to "include all certificates in the certification path" during the export. then reimport the .pfx file back into the personal store. Make sure to assign the certificate to the website in IIS again after the import. This would link all the required intermediates and root certificate and allow the server to send the correct chain.
https://www.geocerts.com/support/cross_root 4/5

24/1/2014

GeoTrust Cross Root Install on Windows Servers

https://www.geocerts.com/support/cross_root

5/5