Vista - SSL errors in Vista

I've got a really knotty problem with Vista, I'm hoping someone has a clue
how to fix it.

First of all, the environment is all standard Microsoft, there is a URL
blocker but I have determined this has nothing to do with it by turning it
off completely, plus it's not a firewall problem, all ports are open. Most
importantly, all of the XP and 2003 machines on the network have IE7 and DO
NOT exhibit this problem and appear to work perfectly normally.

When I start up Live Messenger, I get extended error code 80048418. This
means nothing to me, the only references I can find are to SSL problems.
When I log the connection string, the log reports problems communicating on
port 443, but it appears to be able to connect on port 443. The diagnostic
tool says it can find the server no problem. All the 2003 and XP boxes on
the domain don't have a problem.

When I go into IE, all https sites come up with a certificate error, "The
security certificate presented by this website was not issued by a trusted
certificate authority". I've tried installing the certificates in the
trusted certificate authority store, it has no effect. Once again, doesn't
happen in IE7 on any of the non-Vista machines.

Bear in mind we have several Vista Business machines, they all have the same
problem. I tried installing Vista as a standalone installation, that machine
does not exhibit the problem.

This made me think it must be something in the GPO, but all the SSL settings
are default, and all the 2003 and XP machines are subject to the same GPO
anyway.

The only thing I can think of is that there is some weird difference in the
registry, but I'm stumped at this point.
--
Steve.
MCSA 2003

I've found a workaround by importing all the root certificates off an XP
machine, but that's not really ideal, why won't Vista do it?
--
Steve.


"Steve-UK" wrote:

> I've got a really knotty problem with Vista, I'm hoping someone has a clue
> how to fix it.
>
> First of all, the environment is all standard Microsoft, there is a URL
> blocker but I have determined this has nothing to do with it by turning it
> off completely, plus it's not a firewall problem, all ports are open. Most
> importantly, all of the XP and 2003 machines on the network have IE7 and DO
> NOT exhibit this problem and appear to work perfectly normally.
>
> When I start up Live Messenger, I get extended error code 80048418. This
> means nothing to me, the only references I can find are to SSL problems.
> When I log the connection string, the log reports problems communicating on
> port 443, but it appears to be able to connect on port 443. The diagnostic
> tool says it can find the server no problem. All the 2003 and XP boxes on
> the domain don't have a problem.
>
> When I go into IE, all https sites come up with a certificate error, "The
> security certificate presented by this website was not issued by a trusted
> certificate authority". I've tried installing the certificates in the
> trusted certificate authority store, it has no effect. Once again, doesn't
> happen in IE7 on any of the non-Vista machines.
>
> Bear in mind we have several Vista Business machines, they all have the same
> problem. I tried installing Vista as a standalone installation, that machine
> does not exhibit the problem.
>
> This made me think it must be something in the GPO, but all the SSL settings
> are default, and all the 2003 and XP machines are subject to the same GPO
> anyway.
>
> The only thing I can think of is that there is some weird difference in the
> registry, but I'm stumped at this point.
> --
> Steve.
> MCSA 2003

Anyone got any clue about this problem because PSS aren't being much help,
they're stumped.

Steve.


"Steve-UK" wrote:

> I've found a workaround by importing all the root certificates off an XP
> machine, but that's not really ideal, why won't Vista do it?
> --
> Steve.
>
>
> "Steve-UK" wrote:
>
> > I've got a really knotty problem with Vista, I'm hoping someone has a clue
> > how to fix it.
> >
> > First of all, the environment is all standard Microsoft, there is a URL
> > blocker but I have determined this has nothing to do with it by turning it
> > off completely, plus it's not a firewall problem, all ports are open. Most
> > importantly, all of the XP and 2003 machines on the network have IE7 and DO
> > NOT exhibit this problem and appear to work perfectly normally.
> >
> > When I start up Live Messenger, I get extended error code 80048418. This
> > means nothing to me, the only references I can find are to SSL problems.
> > When I log the connection string, the log reports problems communicating on
> > port 443, but it appears to be able to connect on port 443. The diagnostic
> > tool says it can find the server no problem. All the 2003 and XP boxes on
> > the domain don't have a problem.
> >
> > When I go into IE, all https sites come up with a certificate error, "The
> > security certificate presented by this website was not issued by a trusted
> > certificate authority". I've tried installing the certificates in the
> > trusted certificate authority store, it has no effect. Once again, doesn't
> > happen in IE7 on any of the non-Vista machines.
> >
> > Bear in mind we have several Vista Business machines, they all have the same
> > problem. I tried installing Vista as a standalone installation, that machine
> > does not exhibit the problem.
> >
> > This made me think it must be something in the GPO, but all the SSL settings
> > are default, and all the 2003 and XP machines are subject to the same GPO
> > anyway.
> >
> > The only thing I can think of is that there is some weird difference in the
> > registry, but I'm stumped at this point.
> > --
> > Steve.
> > MCSA 2003

It sounds as if your root certificates in the default Vista install are not
complete - what's the list of root certificates in a copy of your Vista
install - at install time, then after you've plugged in to the domain and
applied GPOs?

Alun.
~~~~

"Steve-UK" <SteveUK@discussions.microsoft.com> wrote in message
news:9F1D65F3-CEF6-4104-9A1B-8E4E3A6B4391@microsoft.com...
> Anyone got any clue about this problem because PSS aren't being much help,
> they're stumped.
>
> Steve.
>
>
> "Steve-UK" wrote:
>
>> I've found a workaround by importing all the root certificates off an XP
>> machine, but that's not really ideal, why won't Vista do it?
>> --
>> Steve.
>>
>>
>> "Steve-UK" wrote:
>>
>> > I've got a really knotty problem with Vista, I'm hoping someone has a
>> > clue
>> > how to fix it.
>> >
>> > First of all, the environment is all standard Microsoft, there is a URL
>> > blocker but I have determined this has nothing to do with it by turning
>> > it
>> > off completely, plus it's not a firewall problem, all ports are open.
>> > Most
>> > importantly, all of the XP and 2003 machines on the network have IE7
>> > and DO
>> > NOT exhibit this problem and appear to work perfectly normally.
>> >
>> > When I start up Live Messenger, I get extended error code 80048418.
>> > This
>> > means nothing to me, the only references I can find are to SSL
>> > problems.
>> > When I log the connection string, the log reports problems
>> > communicating on
>> > port 443, but it appears to be able to connect on port 443. The
>> > diagnostic
>> > tool says it can find the server no problem. All the 2003 and XP boxes
>> > on
>> > the domain don't have a problem.
>> >
>> > When I go into IE, all https sites come up with a certificate error,
>> > "The
>> > security certificate presented by this website was not issued by a
>> > trusted
>> > certificate authority". I've tried installing the certificates in the
>> > trusted certificate authority store, it has no effect. Once again,
>> > doesn't
>> > happen in IE7 on any of the non-Vista machines.
>> >
>> > Bear in mind we have several Vista Business machines, they all have the
>> > same
>> > problem. I tried installing Vista as a standalone installation, that
>> > machine
>> > does not exhibit the problem.
>> >
>> > This made me think it must be something in the GPO, but all the SSL
>> > settings
>> > are default, and all the 2003 and XP machines are subject to the same
>> > GPO
>> > anyway.
>> >
>> > The only thing I can think of is that there is some weird difference in
>> > the
>> > registry, but I'm stumped at this point.
>> > --
>> > Steve.
>> > MCSA 2003