Re: SMTP and IMAP SSL Certificates

For the sake of convenience (and if there's really no other use for an
internal CA), I would go with a cheaper cert from a recognized CA. Given the
prices of these certs, it's not worth installing and maintaining an
internal/in-house CA for issuing 1 or 2 certs, imo.

If you're just interested in figuring out what's going on and don't care how
much time you spend on this as long as you understand/learn something,
continue troubleshooting. Check if the CA appears as a Trusted Root CA in
the **computer's account** - from the certficates snap-in.
--
Bharat Suneja
MVP - Exchange
www.zenprise.com
NEW blog location:
www.exchangepedia.com/blog
----------------------------------------------


"omgitsmit" <OMGITSmit@xxxxxxxxx> wrote in message
news:1155837305.289067.10690@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
I made sure i did install the CA as an Enterprise CA.

I found a great MS article that lets you create a .asp html document
which you can store on your IIS web server. When the client opens that
.asp page it prompts you to install and trust the certificate i
specify.

So far, thats not working either.

I may just buy the $25 certificate, any special place i should start
looking?


Bharat Suneja [MVP] wrote:
Most likely the CA you installed is not an Enterprise CA (gets published
in
AD).

Add the CA as a trusted CA on the client side. Can be done from AD as
well.

This may help:
http://support.microsoft.com/default.aspx?scid=kb;en-us;q313197&sd=tech
--
Bharat Suneja
MVP - Exchange
www.zenprise.com
NEW blog location:
www.exchangepedia.com/blog
----------------------------------------------


"omgitsmit" <OMGITSmit@xxxxxxxxx> wrote in message
news:1155827881.783378.139320@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
I created a SSL certificate locally with a local CA on the domain
controller. I applied this certificate to my IMAP and SMTP virtual
servers in Exchange 2003, which is also located on the very same
server.

Whenever my clients or i connect to check our mail, i get a "Internet
Security Warning" window that states "The server you are connected to
is using a security certificate that could not be verified. A
certificate chain processed, but terminated in a root certificate which
is not trusted by the trust provider. Do you want to continue using
this server?"

In order to initiate the SSL connection for email, you would have to
accept this message every time you open up Outlook 2003.

Is there anyway to get the CA server to trust this certificate? It
sounds like it's the client side that doesn't trust the certificate,
now that i really think about it.

Any help would be greatly appreciated!




.

Relevant Pages

  • Re: how can you verify that the site you get is not a fake?
    ... >> know what the information shoudl be from the server with the ssl cert, ... > The information sent to the client is the server's public key bearing ... In order to play ball you don't just need the certificate (or ... Web certs and so on) identity is valid and passes some validity ...
    (Fedora)
  • Re: Error issuing certificates from WS03 cert svc
    ... is able to issue end entity certs.Next, I restored the revoked CA certs. ... I still get the same error on the original issuing CA ... certificate. ... I'm having trouble with issuing certificates from a Windows Server 2003 ...
    (microsoft.public.windows.server.security)
  • Re: Issue with Certificate name on Web Server
    ... display a warning to everyone who access our https sites. ... in our MS CA and it shows the server having two Certs issued the same ... the subject name in certificate on server and name, ...
    (microsoft.public.windows.server.general)
  • Re: PLEASE HELP ! L2TP & Certificates
    ... server are issued from the same CA. ... I am just guessing but does the root cert get installed on your client when ... u import the certs? ... do I have to install a certificate on the VPN server for EVERY ...
    (microsoft.public.win2000.ras_routing)
  • RPC over HTTP, Microsoft solution
    ... Exchange Server 2003 RPC over HTTP Deployment Scenarios ... Place a check in the box next to 'Certificate Services' and click 'Yes' ...
    (microsoft.public.exchange.setup)