Ssl – RapidSSL not trusted using the check on “why no padlock”

From the typical end-users perspective there is effectively no difference between most certificates. Some even call the SSL system a scam. Even the EV certificates don't really make much to the typical end user over a cheap certificate. As long as the browser doesn't complain, most users are happy.

Unless you are running a bank, or have a large number of highly paranoid security professionals as customers then I suggest you get the cheapest certificate you can.

CA certificates are downloaded based on URL information in the Authority Information Access (AIA) extension of the issued certificates.

Firefox, last I heard, uses its own certificate store and/or chaining engine. Chrome and IE use the one in Windows.

Certificate Validation Process

When a certificate is presented to an application, the application must use the certificate chaining engine to determine the certificate’s validity. Only after the certificate chain is successfully validated can the application trust the certificate and the identity represented by the certificate. Three distinct but interrelated processes are used to determine a certificate’s validity:

■ Certificate discovery To build certificate chains, the certificate chaining engine must collect the issuing CA certificate and all CA certificates up to the root CA certificate. CA certificates are collected from the CryptoAPI cache, Group Policy, or Enterprise Policy, or, as a last resort, downloaded from Authority Information Access (AIA) Uniform Resource Locators (URLs) in issued certificates. Once a certificate is downloaded from a location other than the CryptoAPI cache, it is added to the user’s CryptoAPI cache for faster retrieval.

■ Path validation When the certificate chaining engine validates a certificate, it does not stop at the presented certificate. Each certificate in the certificate chain must be validated until a self-signed root certificate is reached. Validation tests can include verifying authenticode signatures, determining whether the issuing CA certificate is included in the NTAuth store, or the inclusion of specific application or certificate policy object identifiers (OIDs). If one certificate fails the validity test, it is possible that the entire chain will be deemed invalid and not used by the calling application.