Problem with this website's security certificate.

Question

Problem with this website's security certificate.

Lucas Peñaloza 341

Dear;

We are receiving the following message.

User's image

This is a website that is hosted on an IIS server!!!.

User's image

The Bindings;

User's image

And indeed, we see the certificate!!!.

User's image

Now, if we obtain a new certificate, where should we place the new certificate?

User's image

Only in Personal - Certificates????.

The certificate must have some special characteristic????.

Thank you so much,

Answer accepted by question author

5 additional answers

Your answer

Answer 1

Hi Lucas Peñaloza,

I'm glad to see you successfully received and imported the new certificate! That is a big step forward. The red "X" you are seeing now in the Certification Path tab is actually a very common next hurdle.

You are completely correct that your new server certificates are not expired (valid until 2026/2028). However, Windows checks the entire "chain of trust" from top to bottom. Even if your new certificate is perfectly valid, the system won't trust it because the "parent" certificate that issued it—in this case, the intermediate authority named IssuingCAGrupoTelecom—has expired on your local machine. If any link in the chain is broken, the whole chain fails validation.

To fix this, you do not need to change your new server certificates. Instead, you need to reach out to the team that provided them to you (likely your internal IT/PKI team or the Grupo Telecom vendor) and ask them for the updated Intermediate CA certificate for IssuingCAGrupoTelecom.

Once you receive that updated intermediate certificate file, open your MMC console again. But this time, instead of putting it in the Personal folder, you must import it into the Local Computer > Intermediate Certification Authorities > Certificates store.

Once that updated parent certificate is safely in the Intermediate store, that red X should immediately disappear, and your IIS site will finally be fully trusted by browsers.

Let me know if you are able to get your hands on that intermediate certificate!

Tracy.

Answer 2

Tracy Le 3,555 Independent Advisor

Hi Lucas Peñaloza,

I'm just checking in to see if you were able to get your new certificate imported and successfully bound to your IIS site.

Did the steps I shared help clear up those browser warnings? Please let me know if you're still running into any trouble or have any other questions. I'm always happy to help.

Tracy.

Answer 3

The warning indicates a problem with the HTTPS server certificate in IIS, not with the IIS site itself. When replacing it, both placement and certificate properties matter.

Where to place the new certificate

For an IIS HTTPS binding the server certificate must:

Be in the Local Computer certificate store, not the Current User store.
Be in the Personal → Certificates store of Local Computer.
Contain the private key.

If the certificate is imported without a private key, IIS cannot use it. Scenario 1 in the reference shows how to verify this and how to repair the mapping if needed:

Open the certificate from the MMC snap‑in and confirm that it says “You have a private key that corresponds to this certificate.”
If the private key is missing, import a .PFX that includes the private key, or use certutil -repairstore as shown.

Binding the new certificate in IIS

After importing the new certificate into Local Computer → Personal → Certificates:

Open IIS Manager.
Select the site (for example, WonderWebToken).
Choose Bindings… → https → Edit….
In SSL certificate, select the new certificate from the drop‑down list and save.

If HTTPS still fails, follow the additional checks from the SSL troubleshooting article:

Confirm the certificate chain is trusted. If you see CERT_E_UNTRUSTEDROOT (0x800b0109) when validating the chain, import the issuing CA’s root certificate into Trusted Root Certification Authorities on the server.
Ensure the certificate’s Enhanced Key Usage includes Server Authentication and that “Enable all purposes for this certificate” is selected.
Verify that HTTP.sys has a correct SSL binding for the IP:port using netsh http show ssl. If the certificate hash or Application ID is blank or all zeros, delete the bad binding with netsh http delete sslcert ipport=0.0.0.0:443 and then re‑create the HTTPS binding in IIS.

These steps ensure the new certificate is correctly placed, trusted, and bound for use by the IIS site.

References:

Answer 4

Hi Lucas Peñaloza,

That is a fantastic question and a very common point of confusion when dealing with certificate chains.

The short answer is no, you do not need a private key for the intermediate certificate.

Private keys are strictly required for your specific end-server certificate (the one you already successfully imported into the Personal folder) because your IIS server needs it to actively encrypt and decrypt the web traffic. The intermediate certificate, however, is only used by Windows to verify the "chain of trust" and prove who issued your server's certificate. For that validation process, only the public portion of the certificate is needed.

So, when you request the updated IssuingCAGrupoTelecom certificate from your PKI or vendor team, a standard .cer or .crt file (without a private key) is exactly what you want. You can simply import that file straight into the Local Computer > Intermediate Certification Authorities > Certificates store, and that red "X" should finally disappear.

Let me know how it goes once you get your hands on that file!

Tracy.

Answer 5

Hi Lucas Peñaloza,

Thank you for providing such clear screenshots; it really helps to see exactly what you are working with. The certificate warnings you are seeing are completely expected because the current certificate expired back in 2020, and the name on the certificate (srvwonderpos.personal.corp) doesn't match the address you are typing into your browser (localhost).

To answer your first question about where to place the new certificate: you are exactly right. It needs to be imported into the Personal > Certificates folder, but it is crucial that you ensure you are in the Local Computer certificate store (which your MMC screenshot confirms you are), rather than the Current User store. If it's not in the Local Computer store, IIS simply won't be able to see it. Once imported there, you can go right back to your IIS Site Bindings window, edit the HTTPS binding, and simply select the new certificate from the drop-down menu.

Regarding your second question about special characteristics, yes, there are a few specific requirements the new certificate must meet to work properly with IIS and clear those browser warnings:

First and foremost, it must contain a private key. Just like the old certificate in your screenshot shows the little key icon and the message "You have a private key that corresponds to this certificate," the new one must have this as well. Typically, this means you need to import a .pfx file (which bundles the certificate and the key together) rather than just a .cer file.

Secondly, the certificate's "Enhanced Key Usage" properties must be set up to include "Server Authentication".

Finally, as a best practice to avoid that "issued for a different website's address" warning in the future, ensure the new certificate is generated with a Subject Name or Subject Alternative Name (SAN) that exactly matches the actual URL users will type into their browser to access this server.

I hope this response provided some helpful insight. If it clarified the issue for you, please consider marking it as Accept Answer so others with the same issue can find the solution.

Tracy.

Share via

Problem with this website's security certificate.

5 additional answers

Your answer