GlobalSign Trust Hierarchy for DomainSSL

	Secure SSL Certificates \| Home \| Contact Us

Customer Support > SSL Certificates > Root Certificate

GlobalSign Trust Hierarchy for DomainSSL

For DomainSSL Certificates the following trust hierarchy is used:

IMPORTANT NOTE: For your DomainSSL certificate to work on all browsers transparently you must install the Intermediate Root CA (seen in this diagram and called "GlobalSign Domain Validation CA" using the instructions corresponding to your web server. If you have not already copied the Domain Validation CA Certificate to your web server, click here to do so now.

Root Certificate Install Instructions

For Install instructions of the root certificates for your DomainSSL Certifcate, please select your web server from the following:

IIS 4, IIS 5 and IIS 6
Apache
Stronghold
Netscape iPlanet
IBM Websphere
Lotus Domino

Microsoft IIS 4.0, IIS 5.0 and IIS 6.0 Intermediate Root CA Certificate Install

Download the Intermediate Root CA Certificate (named "Domain Validation CA") and rename with a file extension of .cer. Double click the .cer file:

Click on "Install Certificate"

Click on "Next"

Select "Place all certificates in the following store" and Click on "Browse"

A new window will pop up

Select "Show physical stores"

Select "Intermediate Certification Authorities" and then "Local Computer"

Click "OK", this window will close and you will see the following screen

Click on "Next"

Click on "Finish"

Note for Windows NT

ServicePack 3: install the GlobalSign root(s) in your Internet Explorer, and use the IISCA batch file to transfer all root certificates from your Internet Explorer to the IIS (see Microsoft KnowledgeBase Q216339).

ServicePack 4: install the GlobalSign root certificate(s)manually in a specicfic root store: "Show physical stores/Trusted Root Certification Authorities/Local Computer" (see Microsoft KnowledgeBase Q194788).

ServicePack 5 and 6: same as SP4.

Apache Root Certificate Install

Make sure you have copied the Domain Validation CA Certificate to your web server: click here for Root Download Page

- If you saved the file as a TXT file, rename .crt (e.g. gs_domain_ca.crt)

- Save the file to apache/conf/ssl/ - when installed the directory will look like: apache/conf/ssl/ gs_domain_ca.crt

- STOP your apache server.

- Locate the httpd.conf file and open it in a text editor

- Locate the SSLCaCertificateFile directive in the httpd.conf file and remove the leading # from the line.

- Modify the path at the end of the line to reference the location where you saved the gs_domain_ca.crt file.

For example: SSLCaCertificateFile /usr/local/ apache/conf/ssl/ gs_domain_ca.crt

- Restart Apache

Stronghold Root Certificate Install

Stronghold needs to have access to the chain of certificates of the CA (certificate authority) that signed the certificate. These certificates are placed by GlobalSignas defualt in the in a file that contains several PEM encoded certificates :

./stronghold/ssl/CA/client-rootcerts.pem

If the file client-rootcerts.pem does not contain the GlobalSign certificates, then append the following to the file :

Netscape iPlanet Root Certificate Install

Installing the GlobalSign Root CA

Select SECURITY
In INSTALL CERTIFICATE: select TRUSTED CERTIFICATION AUTHORITIES
Select CRYPTOGRAPHIC MODULE: internal (software)
In "Message is in this file: enter the Path to the local file in PEM format which contains the GlobalSign Root CA certificate.
In CERTIFICATE NAME: Enter a friendly name for this certificate: for example GlobalSign Root CA.
Repeat this for The Domain Validation CA Certificate

IBM WebSphere Root Certificate Install

Before you can add your certificate into the keystore, you must first include the GlobalSign's Certificates chain for the Product you chose. For instance, if you choose for Secure Server, you have to install public certificates. They can be found Here.

You can add this certificates chain from the Signer Certificates screen as shown below:

Click on the Add button. A dialog box asking will appear where you have to enter the Data type (Base64-encoded ASCII data), the Certificate file name (the certificate file you received from GlobalSign) and its location. Once all of these information are entered, just click on OK

Lotus Domino Root Certificate Install

You must install the GlobalSign Root certificates into the Server Certfiicate Admin application. Download the .PEM files - can be found here.

For each of the root certfiicates, copy the content in the clipboard - i.e:

-----BEGIN CERTIFICATE-----
CERT
-----END CERTIFICATE-----

You have then to paste it in the Server Certificate Admin application. You may check if they are considered as Trusted Root (they must be) in the View & Edit Key Rings main entry (left on the main screen). If they are not, double click on the certificate that you want to manage and enable this option.

	Home \| SSL Certificates \| Products \| Enterprise Solutions \| Partners \| Customer Support \| About GlobalSign \| Customer Login	© GlobalSign. All rights reserved.
	GlobalSign Inc (a member of GMO Internet Inc group TSE:9449) offers online security services and has been operating as a trusted Root Certification Authority for over 10 years. GlobalSign Certificates are trusted by all popular Browsers, Operating Systems, Devices and Applications and include SSL, SSL Certificates, Extended SSL Certificates, Code Signing, Personal Digital IDs, Enterprise Digital IDs, internal PKI & Microsoft CA root signing.