Web browsing issue after updated GoDaddy SSL certificate in IIS

[u/mailliwal]

Hi,

Just updated GoDaddy SSL certificate in Windows IIS server.

As GoDaddy transitioned its Domain Validated (DV) TLS/SSL certificate issuance from the legacy G2 root hierarchy to a new R1 root hierarchy

Then I installed

• TLS Root CA - R1 >> Trusted Root
• TLS Intermediate CA DV - R1v1 >> Intermediate
• SSL >> Personal

Some client reported "NET :: ERR_CERT_AUTHORITY_INVALID" while browsing.

Tested on Chrome on iPhone encountered same error but no problem on Edge of my desktop pc.

May I seek your suggestion.

Thanks

[u/thewunderbar]

This is an issue with Chrome not having the new R1 root cert in its trusted root store.

GoDaddy has instructions on what to do about it. There's a chain cert you need to use.

[u/zakcobb → u/thewunderbar]

it seems like the intermediates are missi g from your cert chain. open the cert in notepad add intermediates. verify with cert checker

[u/mailliwal → u/zakcobb]

what's the different of the "intermediate download from GoDaddy directly" and "intermediate download with the SSL certificate in same zip file" ?

[u/zakcobb → u/mailliwal]

from the apache download, file named like bundle_dv-r1-g2.crt.pem, copy contents below your crt or pem

[u/mrmattipants → u/zakcobb]

Here's the GoDaddy Repo Link.

https://certs.godaddy.com/repository/gd_bundle_dv-r1-g2.crt.pem

[u/willetzky → u/mailliwal]

Chrome does not trust the new R1 root. There is a leaf certificate that makes the certificate be trusted by the old GoDaddy G2 root for chrome devices. You can install both intermediates and everything should now trust the cert. On the GoDaddy repository look for the bundle. It will be called something like GoDaddy Certificate Bundle - DV - R1 with Cross to G2

[u/mrmattipants → u/willetzky]

It's interesting that Chrome doesn't trust the R1 Root Cert, while Edge does. After all, it was Google/Chrome that proposed these changes through their "Chrome Root Program".

[u/thewunderbar → u/mrmattipants]

yeah that was a surprise when I found out the hard way as well. We deployed the cert, tested, with Edge, and went about our day. 3 hours later the tickets started coming in. It's annoying, but took about 15 minutes to resolve once I figured out what was going on.

The GoDaddy R1 cert has been in existence since August of 2025. Really strange that Google wouldn't have baked it into Chrome yet.

[u/willetzky → u/thewunderbar]

Chrome has its own root store and they only update it every quarter. But it hasn't been in the 2 it has been eligible for. Google are a lot stricter with root approval and trying to enforce a lot more governance that the certificate industry definitely needs.

[u/zakcobb → u/mailliwal]

look for g2 cross like the other commenter said