Fix an untrusted root or certificate error (Windows IIS only)

If you or your customers are seeing an "untrusted root" or SSL certificate chain error, your current SSL certificate may need additional certificates in the bundle so web browsers can trust your site. Follow these steps to fix this issue for Windows IIS.

For CSR and private key generated within IIS

1. Download the new bundle and copy it to one of the IIS servers.
2. Open MMC and add the certificate view snap in.
3. Right-click Intermediate Certificates, select Import, and then browse to the .p7b file that came in the new bundle. Select the file and import it, and when the import is done you'll see a success message.
4. Open IIS manager and go to Server Certificates.
5. Select Complete Certificate Request and browse to the .cer that came in the bundle.
6. Import the bundle to your local machine, and when the import is done you'll see a success message.
7. In MMC, right-click the new certificate that was imported and select Export.
8. Choose to export the private key as well, provide a new name/path for the .pfx, and then install the newly created .pfx on your webservers and bind to any site that needs it.

For CSR and private key generated externally (for example, in OpenSSL)

1. Run this command to create a PFX file:
   openssl pkcs12 -export -out [newFileName.pfx] -inkey [privateKey] -in [newBundleFileName]
   where:
   
   • newFileName is the output file name for the PFX (for example, coolexample_new.com.pfx)
   • privateKey is the private key file (for example, coolexample.com.key)
   • newBundleFileName is the certificate bundle to include (for example, coolexample.com_bundleNoG2.crt)
   Enter your password when prompted.
2. Upload the PFX to your server and double-click to begin the install.
3. Select Local Machine and select Next.
4. Select Verify Filename and select Next.
5. Select Input Password (we always recommend doing so for increased security), select Select Mark Key Exportable and then select Next.
6. Select Automatically Select Certificate Store, select Next and then select Finish. When the import is complete, you'll see a success messsage.

View the certificate

No matter how you installed the bundle, here's how to view the installed certificate:

1. Open a command prompt, type MMC and press Enter.
2. In MMC, select File and then select Add/Remove Snap-in.
3. In the left menu, select Certificates and select Add.
4. Select Computer Account and then select Next.
5. Select Local Computer and then select Finish.
6. Select OK.
7. Navigate back to Certificates (Local Computer), select Personal and then select Certificates. The new certificate appears in the list.

More info

• Why is GoDaddy removing ClientAuth EKU and transitioning to the R1 root hierarchy for DV TLS issuance?: Explains why you saw the "untrusted root" or certificate chain error in the first place.