I have a web site hosted on IIS webserver. I've created a self-signed certificate for the web site and installed on a client machine. When I install the certificate to a client machine, I can establish trusted connection between the client and the web site. But there's this problem that after some time -which is approximately something like 2 weeks- the certificate installed in the client becomes invalid and I can no longer make SSL connection. Just reinstalling the same certificate helps shoot away the problem. Do you have any idea why would this happen? What should I do to prevent this?

EDIT: The client runs Windows7. Browser is Google Chrome. When I say reinstalling, I mean on the client machine and by adding it to the trusted root. It happens about every 2 weeks.

EDIT2: I've just realized that the error message is generated from a windows app that my web application uses to sign documents electronically. So it's not related to a browser.

migrated from crypto.stackexchange.com Jun 7 '16 at 12:31

This question came from our site for software developers, mathematicians and others interested in cryptography.

  • When you go to reinstall it, does the old certificate still show up in the trusted root or is it gone? – mikeazo Jun 7 '16 at 12:11
  • When I reinstall it, it overrides the old one. So there's always only one piece of that certificate in the store. BTW, that link you pointed out to seems to be helpful. – Mikayil Abdullayev Jun 7 '16 at 12:19
  • The link I posted was lost in migration. But this was the unhelpful link. Adding so that others don't have to. – mikeazo Jun 7 '16 at 12:33
  • Does the problem only happen in Chrome or other browsers too? – mikeazo Jun 7 '16 at 12:33
  • 1
    Firefox does not care about the Windows cert stores. It has its own independent cert management. Chrome however uses the OS facilities. What is the error message you get in Chrome and IExplore? – StackzOfZtuff Jun 7 '16 at 13:51

The X.509 standard (https://en.wikipedia.org/wiki/X.509) defines how certificates have to look like and there is a mandatory field defining how long a cert should be valid.

Not sure how you created the cert (maybe from IIS management panel?). But I guess your tool just chooses a short lifetime for you cert by default. Either find a way to create a long living cert (like a year or more) with your current tool or use openssl to create it by hand (see https://stackoverflow.com/questions/10175812/how-to-create-a-self-signed-certificate-with-openssl) so you can explicitly choose the lifetime of your certificate.

  • If he is only reinstalling the same certificate on the client (not on the server), then the expiration date is most definitely not the issue. Hence one of the questions in my comment. – mikeazo Jun 7 '16 at 11:53
  • 1
    True. He now elaborated on this. – Thekwasti Jun 7 '16 at 11:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.