IIS Still Shows ERR_CERT_AUTHORITY_INVALID After Installing a GoDaddy SSL Certificate

Importing a root certificate into the server’s intermediate store does not necessarily fix what remote browsers receive. Verify the binding, hostname, SNI settings, expiration, and the chain presented over the network rather than relying only on the IIS certificate viewer. If the external checker shows that IIS is not sending the intermediate, install the intermediate in the Local Computer intermediate store and rebind the PFX. Also test from a clean client because Chrome may have cached an earlier chain.

Make sure the PFX was built from the private key that matches the CSR used for this certificate. You can verify that by comparing the public key or modulus from the certificate and key with OpenSSL. The P7B is a certificate bundle, not a private key, and can be imported into Windows or converted to PEM certificates for use with OpenSSL. A typical command is `openssl pkcs12 -export -out site.pfx -inkey site.key -in site.crt -certfile intermediates.crt`, where `intermediates.crt` contains the appropriate GoDaddy intermediate certificates.

GoDaddy’s newer certificates can involve the Starfield hierarchy and cross-signed roots. Different clients build that chain differently, which can make Chrome fail even when the certificate looks complete in IIS. Check the certificate actually being served with an external TLS checker, then remove obsolete or cross-signed copies from the server and configure IIS to send the current intermediate chain. The server should normally send the leaf certificate plus intermediates; clients provide the trusted root.

This kind of failure has also appeared with GoDaddy certificates issued through Starfield. If the correct intermediate chain is installed and the key matches but Chrome still fails, the practical fix may be to use the exact current Starfield intermediate bundle supplied for that certificate or replace the certificate with one from another issuer. An online chain checker is useful because it shows precisely where validation stops.