SSL Certificate Shows "Not Secure" After Installing a New GoDaddy Certificate on NetScaler.
Article ID: CTX696796
Updated On:
Description
GoDaddy has recently started issuing new Domain Validated (DV) SSL certificates under a new certificate hierarchy called R1, replacing its long-standing G2 hierarchy. This change affects the intermediate and root certificates used to sign newly issued certificates.
During this transition, two different issues can occur, either individually or at the same time.
The first issue is an incomplete certificate chain. The server must present both the server certificate and its intermediate certificate during the TLS handshake. If the intermediate certificate is not installed and linked correctly to the server certificate, browsers cannot build a complete trust chain, and the website may be displayed as "Not Secure", even though the server certificate is valid.
The second issue is the new R1 root certificate. Since this root certificate is still being distributed to browser and operating system trust stores, some client devices do not yet recognize it as a trusted root. Even if the certificate chain is complete, these clients may still show a trust warning. To address this, GoDaddy provides a cross-signed certificate, which allows the certificate chain to validate through the older and widely trusted GoDaddy Root CA G2 until the R1 root certificate is broadly trusted.
Since both of these issues can result in the same "Not Secure" browser warning, it is important to verify both the certificate chain and the trust path when troubleshooting certificates issued under the new R1 hierarchy.
Trust Store Validation
Use the SSL Labs Server Test (or a similar SSL validation tool) to verify the certificate trust status across major browser and operating system trust stores.
Before installing the required intermediate and cross-signed certificates, the validation may report the certificate as "Not Trusted" across one or more trust stores, as shown below.
After installing and correctly linking the updated intermediate certificate and the R1 to G2 cross-signed certificate, rerun the validation. The certificate should be reported as "Trusted" across all major trust stores, confirming that the certificate chain is being validated successfully.
Environment
Citrix is not responsible for and does not endorse or accept any responsibility for the contents or your use of these third party Web sites. Citrix is providing these links to you only as a convenience, and the inclusion of any link does not imply endorsement by Citrix of the linked Web site. It is your responsibility to take precautions to ensure that whatever Web site you use is free of viruses or other harmful items.
Cause
Certificates issued under GoDaddy's new R1 certificate hierarchy may encounter trust issues if the certificate chain is not configured correctly.
Importing a certificate bundle does not always automatically link the intermediate certificate to the server certificate. If the intermediate certificate is not installed and linked manually, only the server (leaf) certificate is presented during the TLS handshake, resulting in an incomplete certificate chain.
In addition, the GoDaddy TLS Root CA – R1 is a newly introduced root certificate that is still being distributed across browser and operating system trust stores. During this transition period, the R1 to G2 cross-signed certificate is required to allow the certificate chain to validate through the already trusted GoDaddy Root CA – G2 until the R1 root certificate is broadly trusted.
Resolution
Depending on how the certificate files are packaged by the certificate authority, use one of the following methods:
Option 1
- Install the intermediate certificate and the cross-signed certificate separately, then link both certificates to the server certificate.
Option 2
- If the intermediate certificate bundle already includes the cross-signed certificate, install the intermediate certificate bundle as provided, then link the intermediate certificate (which contains the cross-signed certificate) to the server certificate.
Issue/Introduction
Installing a new SSL certificate on a NetScaler appliance and binding it to a virtual server may result in the website displaying a "Not Secure" warning in the browser. This issue can occur with certificates issued under GoDaddy's newer R1 Domain Validated (DV) certificate hierarchy if the certificate chain is incomplete or if the required R1 to G2 cross-signed certificate is not installed.
Additional Information
