an SSL certificate is only valid for a given domain - this is typically either www.domain.com OR domain.com. Wildcard SSL certs are also available (which it appears you have in this case) which will validate *.domain.com, including www.domain.com however still will not validate for domain.com.
Solutions would be:
- redirect from domain.com to www.domain.com (arguably better for SEO)
- purchase a further SSL cert
I invariably go for the 1st option which is easily acheived in IIS or Apache
I had the same problem - bought a basic SSL certificate (from Network Solutions), installed it under nginx, and it worked fine in both Opera and IE - but not Firefox 3.6.12. This is how I solved the problem. Note that I have root/shell access to my VPS, I don't know if you do (at least this might point your providers in the right direction).
The first step in finding the solution was using Qualys (as per this other answer). It told me that the chain was incomplete.
Second, I used OpenSSL for testing/debugging. Assuming you have shell access, you can do the command (q or CTRL-C to disconnect):
openssl s_client -connect mysite.com:443
and you will probably see the error "unable to get local issuer certificate". This is also a way to test when it's working, in the shell, without running Firefox.
Some browsers may complain about a certificate signed by a well-known
certificate authority, while other browsers may accept the certificate
without issues. This occurs because the issuing authority has signed
the server certificate using an intermediate certificate that is not
present in the certificate base of well-known trusted certificate
authorities which is distributed with a particular browser. In this
case the authority provides a bundle of chained certificates which
should be concatenated to the signed server certificate. The server
certificate must appear before the chained certificates in the
combined file
Nginx configuration
In my case, I had gotten three files from Network Solutions - mysite.com.crt, AddTrustExternalCARoot.crt, and NetworkSolutionsDVServerCA.crt. There was no bundle file, but it's possible to create one from the other certificates. After some trial-and-error, I found what I needed was:
$ cat mysite.com.crt NetworkSolutionsDVServerCA.crt > mysite.com.chain.crt
The final step was to reconfigure my nginx server with the new file:
server {
listen 443;
ssl on;
ssl_certificate /etc/ssl/certs/mysite.com.chain.crt;
ssl_certificate_key /etc/ssl/private/mysite.com.key;
server_name mysite.com;
# and so on
}
After getting the right certificates in the bundle, and restarting nginx, openssl reported no errors, Firefox got the page with no problem, and Qualys reported the chain was valid.
Apache configuration
Since you're running Apache, then you (or your providers) need to configure it for SSL with the correct file locations, one of which is the missing intermediate chain file:
<VirtualHost 192.168.0.1:443>
DocumentRoot /var/www/html2
ServerName www.yourdomain.com
SSLEngine on
SSLCertificateFile /path/to/your_domain_name.crt
SSLCertificateKeyFile /path/to/your_private.key
SSLCertificateChainFile /path/to/DigiCertCA.crt
</VirtualHost>
Best Answer
Firefox 3.6.9, Opera 10.62 and Chromium 6.0.472.53 work without problems at my machine. To me it looks like a broken configuration in firefox or bug in this specific version.
Have you tried visiting the site after clearing your profile (preferably in safe-mode)?