asked on

SSL site works on some PC's, but not others.

Hi guys,

We have a load of store PC's still on Windows XP and running IE 8. All of these stores have the same PCs, specs and are all on our network range of 172.16.0.0/16. They all have the same applications, so it won't be another application taking up port 443. Also, our Watchguard firewall is set to permit all of these stores out to the same places. So whatever store 1 can access, store 2 can too.

The company we work with have made changes to their SSL certificates on their website recently and some PC's are able to access the actual IIS 7 page when accessing with HTTPS. And a load of other PC's are unable to reach the IIS 7 page.

My question is this: what on earth can I go back with to the guys who own the web servers? Can I ask them to make certain changes? Is there a binding issue somewhere?

Any diagnostics you can offer would be great.

Thanks guys
Yashy

ASKER CERTIFIED SOLUTION

Dave Baldwin

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

Yashy

ASKER

Hi Dave,

Thanks for responding. I went ahead and downloaded the hotfix and applied the 'Fix'. However, the website still doesn't publish sadly. I installed the fix and restarted the machine.

This is the test site I'm trying to get to https://ssl-test-2.tcppublishing.com

Dave Baldwin

I don't have any trouble getting to that site but all it is is a basic IIS7 logo page. It works the same in Firefox, Chrome, IE8, and Opera on this computer.

Are you getting any error messages?

Yashy

ASKER

I know, it works from my PC at home and it does to from some of the PC's around our stores.

But from the non working PC's if I type the address above with just HTTP it works. If I type it with HTTPS then i get a 'page can't be displayed'. The firewall shows no logs of denials either.

And this all began when the 3rd party made changes to the webserver certificates. So I'm at a loss here. Sadly these stores don't have Firefox installed as they are locked down, so it's basically IE 8 for now!

Dave Baldwin

Can those computers to go any 'https' site? Try going to https://www.comodo.com/ in IE8 since they are the ones that are issuing the certificate.

Also make sure that TLS 1.0 is checked in the Advanced options in Internet Options. In the Content Tab, click on Certificates to view the ones that are installed. Under Intermediate Certificate Authorities, you should see 3 listings for COMODO.

ExpertNotReally

Verify you have the Root Certificate of the issuing authority for that site in your trusted certificate store. Also you may have to add the site itself to the Trusted Sites Security Zone.

Yashy

ASKER

the reason was because SP2 was installed for XP (I know..don't even get me started!) instead of SP3. So the encryption it uses to recognise the algorithm to recognise the certificate was not available for SP2. All sorted now using SP3:)

Thanks guys