IE has started exhibiting a strange behavior. We have several intranet nodes (routers) that are configured to use HTTPS for access, but which have untrusted / self signed certificates on them. At some unidentifiable point in the recent past, there was no problem connecting to these devices. That is no longer true. When you attempt to connect, and choose option 3 ("to connect to the site anyways") IE comes back immediately with a "Connection Unavailable" screen. This occurs in IE8 and now (ugh) ie9.

Firefox has no problem connecting to these locations, which indicates that its not a TCP stack problem. Google Chrome fails to connect; but then Google Chrome fails at a lot of stuff.

We have tried adding them as trusted sites. No difference.

Clearly there is some obscure setting or MS has come out with a patch that breaks things. Any ideas?

  • This question is not really for stack overflow, as it focuses on programming problems. Perhaps Server Fault, where questions are focused on servers, networks, and professional desktop maintenance? – Lomky Jan 17 '12 at 21:32

This problem is caused by a very recent ms update: kb2585542

There is a fixit associated with ms12-006 which allows you to turn off part of the update. Issues are described at http://support.microsoft.com/kb/2643584

Specifically Microsoft Fix it 50824 needs to be applied. You then need to update ie to only use ssl3 and tls1.2 and for our systems this fixed the problem

  • Thanks for posting. If this is indeed the solution, could you please mark this as your answer? – John H Jan 19 '12 at 17:14

Check the certificate section in your browsers. If there are certificates from these devices, delete them, clear your browser's cache and restart the browser.

My HP ILOs would do this sometimes with the self-signed certs. Once you accept the cert, it installs it but the next time you connect it gets all confused for some reason. At least FF and IE used to get confused.


If you have more than just a few of these servers, it's probably worth having a little internal Certification Authority:

  • Create a small CA, in particular your own CA certificate + its private key.
  • Issue certificates using this CA for each of your internal servers (and set it up within that server).
  • Imported the CA certificate as a trusted certificate on your intranet machines.

This way, you won't have to handle exceptions every time you add a new server on your intranet. If you're new to this, it can be a bit of a hassle, but it's the clean way to do it.

There are tools to help you set up a CA. Depending on the size, something like Tiny CA might be sufficient. You may find other suggestions in the answers to this question: https://security.stackexchange.com/q/7030/2435

Make sure the host names in the certificates you issue are in a Subject Alternative Name DNS entry and (just in case) in the CN RDN of the Subject Distinguished Name.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy