Just to clarify on the above answer:
When you set up Certificate Services yourself, and you issue your own certificate, your server is the root Certificate Authority. That means that your CS server is the root server, and there can be other CS servers set up under this root. You can set up a hierarchy of CS servers. This is how companies like Verisign do it. They have servers nested under servers nested under servers, all issuing certificates, and they all trace back to a main root server (that they probably keep powered off, under lock and key; to get that server would give you ultimate CA power!).
Now, in Internet Explorer, under Tools - Options - Content - Certificates - Trusted Root Certificate Authorities, there are a bunch of companies and certificates defined there.
This is how the certificats work in IE. Since Verisign is defined as a Trusted Root CA, any certificate they issue contains the pathing back to the root, which is this certificate. This is how any install of IEcan go to any Verisign-issued SSL site and authenticate the certificate. The certificate says that Verisign is the root CA, that they issued this certificate. Since IE knows Verisign's root CA, then it accepts the certificate and goes on its merry way.
When you set up your own root CA, IE does not know who you are. So, when you go to a locked down web site with a certificate issued by you, the root CA credential is NOT accepted by IE. IE doesn't know you, so it rejects the root path in the certificate.
That leads to the error box you see. It probably says something like the trusted root CA cannot be validated. Something like that.
So, if you want to set up a public web site with SSL, get a certificate from a trusted CA.
Hope this helps.
