Article ID: 182888
If a server SSL certificate is issued by unknown or invalid certificate authority WinInet HttpSendRequest API or MFC CInternetFile::SendRequest will fail with error 12045 (ERROR_INTERNET_INVALID_CA).
When Internet Explorer tries to access the same URL, similar error is reported.
This error occurs when the client does not know about the certificate authority that issued the server certificate. The problem may be corrected by installing the certificate authority's root certificate. A list of all installed certificates can be viewed from Internet Explorer. From the View menu, click Internet Options, click the Content tab, and click Authorities.
It is possible to bypass this error in WinInet application without installing a certificate. There are two methods of handling this error. You can use code similar to the following.
Method 1. With a UI (a message box similar to Internet Explorer is generated):
Method 2. Without a UI:
Similar logic can be used with MFC WinInet classes. In this case, the following MFC methods correspond to the WinInet APIs used above:
NOTE 1: InternetErrorDlg may return following values:
The request should be resubmitted only when ERROR_INTERNET_FORCE_RETRY is returned. In Internet Explorer 4.0 and 4.01, however, the request must be resubmitted even when ERROR_SUCCESS is returned.
ERROR_SUCCESS ERROR_CANCELLED ERROR_INTERNET_FORCE_RETRY.
Microsoft has confirmed this to be a problem in InternetErrorDlg API. NOTE 2: SECURITY_FLAG_IGNORE_UNKNOWN_CA is not implemented in Internet Explorer 3.0 and 3.02.
InternetErrorDlg still works, however, with the following exception. The dialog box generated by this API does not allow ignore invalid certificate authority error; it is merely a notification to the user that page cannot be viewed.
NOTE 3: The option to ignore this error cannot be set before the error occurs. You must first attempt to send the request, receive the error, then set the option (or call InternetErrorDlg), and resubmit.
For additional information, please see the following article(s) in the Microsoft Knowledge Base:
(http://support.microsoft.com/kb/168151/EN-US/ )How to Make SSL Requests Using WinInet
Article ID: 182888 - Last Review: June 22, 2014 - Revision: 4.0
Retired KB Content Disclaimer
This article was written about products for which Microsoft no longer offers support. Therefore, this article is offered "as is" and will no longer be updated.
Contact us for more help