"page cannot be displayed" browsing to https

After applying several security changes to client PC's we are now
experiencing a problem where we cannot access certain SSL sites. I have read
virtually every posting and reference to similar problems in newsgroups and
all over the Internet, but none hit the mark.

Here are some important facts:
1. https connections work fine in Firefox to all sites we have tried
2. IE will connect to SSL sites with certificates from a root authority but
not from untrusted roots. In other words, a site with an "invalid"
certificate will not come up. For example, if another site in our
organization is issuing their own certificates, then we would need to click
Yes to proceed to accept it. Sometimes the warning comes up, but not for all
sites. Regardless, it is these sites that generate the 'page cannot be
displayed' error.
3. We applied several security settings according to DISA standards so I am
primarily looking for people who are familiar with those.

I am thinking along the lines of the problem stemming from tightening a
particular communication setting for Windows. I am hoping someone might have
some insight that could save me from testing individual settings one by one.

Cheers,
-David

Troubleshooting Secure Sites (WinXP/IE6 SP2)
http://support.microsoft.com/?kbid=870700

Sandi's Secure Sites Page
http://inetexplorer.mvps.org/archive...m#secure_sites

Use Security and Privacy Features in Internet Explorer 6 (WinXP)
http://www.microsoft.com/windowsxp/p...curity/ie6.asp

Working with Internet Explorer 6 Security Settings
http://www.microsoft.com/windows/ie/...y/settings.asp

Setting Up Security Zones
http://www.microsoft.com/windows/ie/...rity/setup.asp
--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE/OE, Shell/User, Security), Aumha.org VSOP, DTS-L.org


D S wrote:
> After applying several security changes to client PC's we are now
> experiencing a problem where we cannot access certain SSL sites. I have
> read virtually every posting and reference to similar problems in
> newsgroups and all over the Internet, but none hit the mark.
>
> Here are some important facts:
> 1. https connections work fine in Firefox to all sites we have tried
> 2. IE will connect to SSL sites with certificates from a root authority
> but not from untrusted roots. In other words, a site with an "invalid"
> certificate will not come up. For example, if another site in our
> organization is issuing their own certificates, then we would need to
> click Yes to proceed to accept it. Sometimes the warning comes up, but
> not for all sites. Regardless, it is these sites that generate the 'page
> cannot be displayed' error.
> 3. We applied several security settings according to DISA standards so I
> am primarily looking for people who are familiar with those.
>
> I am thinking along the lines of the problem stemming from tightening a
> particular communication setting for Windows. I am hoping someone might
> have some insight that could save me from testing individual settings one
> by one.
>
> Cheers,
> -David