Tools

Untrusted root or certificate chain error on new GoDaddy SSL certificates in Web Help Desk

After updating the GoDaddy SSL certificate, getting an untrusted root or certificate chain error in Web Help Desk. In Chrome, the error is "NET::ERR_CERT_AUTHORITY_INVALID". This article provides the steps to fix this error.

First published date

7/16/2026 8:59 PM

Last published date

7/16/2026 8:59 PM

Overview

GoDaddy has made some changes to the publicly trusted SSL/TLS certificates for server use. It will no longer include Extended Key Usage for "Client Authentication" (EKU: ClientAuth). Here is the announcement from GoDaddy.

https://www.godaddy.com/en-ph/help/why-is-godaddy-removing-clientauth-eku-and-transitioning-to-the-r1-root-hierarchy-for-dv-tls-issuance-42783

Product section

Web Help Desk

Cause

See announcement from GoDaddy: https://www.godaddy.com/en-ph/help/why-is-godaddy-removing-clientauth-eku-and-transitioning-to-the-r1-root-hierarchy-for-dv-tls-issuance-42783

Resolution

This assumes you have already purchased the certificate and imported the CA REPLY into your keystore or cert file. Find the CA certificate bundle from GoDaddy. Usually, this is included when you download the cert from GoDaddy. The file name is gd_bundle_dv-r1-g2.crt.pem.

For Web Help Desk version 2026.1 and below, using Portecle:

  1. Navigate to C:\Program Files\WebHelpDesk
  2. Open Portecle.bat and run as admin
  3. On Portecle, open the keystore.jks file located in C:\Program Files\WebHelpDesk\conf folder
  4. Enter the keystore password (typically, it is "changeit")
  5.  Once the keystore is open, right-click on the tomcat keypair and select Export
  6. Export the Private Key and Certificates type to PEM Encoded Format

  1. Click OK and enter the Key Pair Entry password (typically, changeit)
  2. Leave the Private Key Export Password blank. Just click OK.
  3. Choose the filename as it is, or choose a different filename. The file type should be PEM file. This will be saved in C:\Program Files\WebHelpDesk\conf folder.
  4. Navigate to this folder and open the file using Notepad, but we prefer using Notepad ++. The file contains the private key, the WHD certificate, and the root and intermediate certificates.
  5. Save a copy of the gd_bundle_dv-r1-g2.crt.pem. Open this file in another instance of Notepad.
  6. On the other instance of Notepad that contains the private key and certificate, copy the top two sections that contain:

-----BEGIN RSA PRIVATE KEY-----

-----END RSA PRIVATE KEY-----
-----BEGIN CERTIFICATE-----

-----END CERTIFICATE-----

  1. Paste this into another Notepad instance that contains the bundled cert. It should be in the top section of the file. Do not overwrite existing bundled certs. Save the file as bundled.pem file.
  2. On Portecle, open a new blank keystore and choose PKCS#12.

  1. Click on Tools and Import Keypair

 

  1. Select the bundled.pem file
  2. You will be prompted by 

  1. You may click Certificate Details to verify that the cert now includes the GoDaddy Root Certificate Authority - G2 certificate and that it lists 4 certificates.

 

 

  1. Click OK twice, and you will be prompted to enter the alias name

  1. Change the alias to tomcat and click OK
  2. Click on Tools and select Set Keystore Password

  1. Save this keystore and set the keystore password to your desired value, as specified in the whd.conf file.
  2. Save it in the C:\Program Files\WebHelpDesk\conf as keystore.jks file. You choose to overwrite the existing keystore.jks file if you already backed up the old file.
  3. Restart the Web Help Desk to apply the changes. 

 

In Web Help Desk version 2026.2 and above, if you are installing for the first time, you may no longer have Portecle. The SSL files for this version are now in PEM file format. You only need the contents of gd_bundle_dv-r1-g2.crt.pem and replace the certs in the cert.pem file. See steps 11 to 18 on How to convert existing keystore.jks file to PEM file format for newer version of Web Help Desk