How do i get Edge to trust our internal Certificate Authority

[Raymond Preston]

Is there any way to get edge to stop flagging our internal certs as non trusted ? Pkiview.msc shows that there are no problems with the CA windows shows the cert is trusted.

Yet edge marks it as invalid. If the cert is verified up to a trusted root CA it should be valid in edge just like it is in internet explorer.

[#2]

@Raymond Preston 

Are you still seeing this behavior in Edge?

Gabriel

[#3]

@v-gapart Yes, On the latest version im still having every single cert signed by our internal CA marked as invalid by edge

When i click on the button there it brings up the Windows Certificate Dialog which shows the certificate is fine 

Nothing crazy with the cert either its a Windows CA issued cert 

v3 Template
sha512RSA
sha512
RSA 4096

Looks fine in internet explorer.

[#4]

I think it would be nice to have a list of urls that can ignore the certificate trust check.

[#5]

Hey Raymond,

Any chance you got a fix for this ?

[#6]

Hi@Raymond Preston 

Did you have resolve this issue?

I have also an internal PKI and internal webistes. All internal sites showed UNSAFE.

Do you have maybe any resolution for this?

 Thanks

Regs

Balazs

[#7]

Hi.

I had this problem a few weeks ago too. (Our internal CA was not trusted in Edge.)

I have fixed it by applying our IE-GPO (Internet Explorer settings) on the machine.

I think the problem is caused by an incomplete, incorrect or missing intranet sites list or intranet zone settings. (But I don't looked for the direct settings which was causing the problem.)

Best regards.

htcfreek

[#8]

Hi,

Can you explain how exactly?

Regards

[#9]

Hi@Nawar-AlMallouhi310 .

I don't know what I should explain to you exactly.

Unfortunatly at the moment I can't reproduce the problem.

But I think the reason could be one of the following setting if it is incorrect:

- Your root ca is not installed.

- Your url is not marked as meber of the zone intranet in the zone-site-list.

Can you posted the shown security warning id (like NET::ERR_CERT_COMMON_NAME_INVALID). You have to reenable the security warning to see it.

Regards.

[#10]

Bump: 2021 now and still no resolution? I've recently run into this deploying an internal ERP solution's web front-end. The solution is designed only to work in Edge; but Edge won't trust our internal domain CA certs no matter what I do. I even spent the last week upgrading PKI signing hash algorithms to make sure we were within current standards (even though the offline root CA in a multi-tier infrastructure shouldn't matter). The solution won't be public facing, so purchasing a public cert seems pointless and a waste for this essentially cosmetic warning.
Looked at this every which way and while I can get Edge to give me different errors depending on how I construct the URL to request our ERP's web page the overarching end result is Edge simply doesn't seem to like internal Domain CA certs.

[#11]

I've found this issue to happen if the Root Certificate or a Certificate in the Path of the WebServer Certificate has a length of less than 4096 bits as that is a requirement of Edge,

https://docs.microsoft.com/en-us/azure/databox-online/azure-stack-edge-gpu-certificate-requirements#...

[#12]

@Raymond Preston in my experience the issue was due to the certificate not containing a Subject Alternative Name.

DNS=MS02-2022.contoso-2022.com

[#13]

@BlakeDrumm 

i had the same problem with edge and chrome but not internet explorer .

here what i did to solve it :

1) On the destination server that need the certificate , launch mmc

2) add certificate => loalhost

3) Create custom Request => Proceed without enrollment policy => No template & PKCS#10

General Tab: 

4)  Frindly name : certificateWebServer

     full : Common Name( "FDQN") ,email, country, Locality,Organization, Organization unit

5) in alternatif name , chose DNS and enter the same as Common Name( "FDQN")

6) in Extension tab => Key usage :

 CRL Signing,Data enciperment,Decipher only,Digital signature, Encipher only

    in Extension tab => Extended Key usage :

server authentificcation

clientauthentificcation

In private Key : 

4096 and activate "Make private key exportable"

7) go on your PKI server (eg: http://myPki.lan/certsrv ) paste the request

8) dowload .cer and install it.

test :)