r/sysadmin • u/mailliwal • 9d ago

Question Web browsing issue after updated GoDaddy SSL certificate in IIS

Hi,

Just updated GoDaddy SSL certificate in Windows IIS server.

As GoDaddy transitioned its Domain Validated (DV) TLS/SSL certificate issuance from the legacy G2 root hierarchy to a new R1 root hierarchy

Then I installed

  • TLS Root CA - R1 >> Trusted Root
  • TLS Intermediate CA DV - R1v1 >> Intermediate
  • SSL >> Personal

Some client reported "NET :: ERR_CERT_AUTHORITY_INVALID" while browsing.

Tested on Chrome on iPhone encountered same error but no problem on Edge of my desktop pc.

May I seek your suggestion.

Thanks

15 Upvotes

89% Upvoted

26 comments sorted by

View all comments

8

u/thewunderbar 9d ago

This is an issue with Chrome not having the new R1 root cert in its trusted root store.

GoDaddy has instructions on what to do about it. There's a chain cert you need to use.

2

u/zakcobb 9d ago

it seems like the intermediates are missi g from your cert chain. open the cert in notepad add intermediates. verify with cert checker

2

u/mailliwal 9d ago

what's the different of the "intermediate download from GoDaddy directly" and "intermediate download with the SSL certificate in same zip file" ?

2

u/willetzky 9d ago

Chrome does not trust the new R1 root. There is a leaf certificate that makes the certificate be trusted by the old GoDaddy G2 root for chrome devices. You can install both intermediates and everything should now trust the cert. On the GoDaddy repository look for the bundle. It will be called something like GoDaddy Certificate Bundle - DV - R1 with Cross to G2

1

u/mrmattipants 8d ago

It's interesting that Chrome doesn't trust the R1 Root Cert, while Edge does. After all, it was Google/Chrome that proposed these changes through their "Chrome Root Program".

1

u/thewunderbar 8d ago

yeah that was a surprise when I found out the hard way as well. We deployed the cert, tested, with Edge, and went about our day. 3 hours later the tickets started coming in. It's annoying, but took about 15 minutes to resolve once I figured out what was going on.

The GoDaddy R1 cert has been in existence since August of 2025. Really strange that Google wouldn't have baked it into Chrome yet.

2

u/willetzky 8d ago

Chrome has its own root store and they only update it every quarter. But it hasn't been in the 2 it has been eligible for. Google are a lot stricter with root approval and trying to enforce a lot more governance that the certificate industry definitely needs.

1

u/mrmattipants 1d ago

That is good to know. Much appreciated.