Re: Root Certificates?????

Tech Tip: Click here to run a free scan for Windows Errors and optimize PC performance

From: Chris Ridd (chrisridd_at_mac.com)
Date: 06/17/04 

Date: Thu, 17 Jun 2004 06:53:08 +0100

On 17/6/04 2:05 am, in article
BCF64A64.392B%see_signature_for_real_email@address.com, "Walt Basil"
<see_signature_for_real_email@address.com> wrote:

> On 6/16/04 14:58, in article 1d2c401c453e4$ae3ba590$a601280a@phx.gbl,
> "Steve" <stephen_archbold@HOTMAIL.COM> wrote:
>
>> I'm new to macs, and have installed Office. I'm trying to set up my e-mail in
>> Entourage, but when I'm getting an error message "Unable to establish
>> secure connection because correct root certificate not installed "
>>
>> I have no idea what this means, can anyone shed some light on what I need
>> to do?
>>
>> Steve
>
> You will see that error when you have SSL authentication set up in your
> account settings when your server doesnąt really have it. Go to Tools >

That's possible, though I suspect you'd get a rather different error back if
that were the case.

I suspect instead that the server *is* using SSL, but the certificate it is
sending Entourage to prove that it is the correct server is signed by a
system that Entourage doesn't yet trust.

--- Aside ---
The way certificates work is this (warning - simplifications ahead): the SSL
server has a key, which is split into a public part and a private part. The
public part can be given to other people as it is mathematically infeasible
to work out what the private part is even if you know the public part.

The public part is digitally signed by another system, which also has a
public and private key. The SSL server's public key is signed by the other
system's private key. This system's public key is also digitally signed by a
third system's private key. And so on.

A signed public key is called a certificate.

A system will only sign a public key if it trusts the owner of that key.
This sometimes involves money.

Obviously this chain (A is signed by B, B is signed by C, ...) can't go on
for ever, so the last public key in the chain of certificates is signed by
its own private key, and is called in the lingo "self-signed". This is a
so-called root certificate.

A chain can be just a single self-signed certificate, but they usually
contain at least two certificates.

Root certificates are often owned by organizations called Certificate
Authorities or CAs. You may have heard of some commercial ones like Verisign
and Thawte.

SSL servers aren't the only things that can have public and private keys -
users can have them too and Entourage 2004 can now use user keys to
digitally sign and encrypt email.
--- Aside ---

So in order for Entourage to verify the SSL connection, it has to verify
each step of the certificate chain. What seems to be happening is that one
step of the chain leads to an unknown certificate, which means that the
entire chain is untrustworthy.

The solution - but only if you trust the server and want to receive email
:-) - is to obtain the untrusted root certificate your server's sending you,
and add it to your Mac's list of trusted root certificates.

I don't know how you'd obtain the certificate, but it might be downloadable
from your provider's support web site. If it isn't, they ought to be able to
email it to you. (Yes, that might be tricky if you can't read email...)

Once you've got the certificate, you need to import it to the keychain
"/System/Library/Keychains/X509Anchors" (which is your Mac's list of trusted
root certificates) using /Applications/Utilities/Keychain Access.

Cheers,

Chris

Relevant Pages

  • Re: Private key generation
    ... As I wrote in my first answer to that thread - there are many situations when key pair is generated on trusted server. ... identity based encryption) simply requires generation of private key on server... ... High assurance keys (especially these that afterward are split in multiple shares using secret sharing schemes) may also require use of specialized equipment and computers that runs in a tempest/EM shielded locations. ... Default scenario supported by Microsoft Certificate Server is the most standard CA mode when CA just signs X509 certificate with emedded public keys. ...
    (microsoft.public.dotnet.security)
  • Re: Certificate key access under Network Service in IIS 6
    ... Haven't done that because I've been remoted in to the customer's server. ... It is likely the private key file but might be a registry key as well. ... I can get the signing process to work if I have the IIS Application Pool configured to run under SYSTEM but running under the preferred NETWORK SERVICE account the private key access of the certificate fails. ...
    (microsoft.public.dotnet.security)
  • Re: How to use certificates?
    ... I expect that server will know the client public key, ... > private key for that certificate. ...
    (microsoft.public.dotnet.framework.webservices.enhancements)
  • Re: Private key generation
    ... Some encryption schemes (like f.e. ... identity based encryption) simply requires generation of private key on server... ... Default scenario supported by Microsoft Certificate Server is the most standard CA mode when CA just signs X509 certificate with emedded public keys. ...
    (microsoft.public.dotnet.security)
  • Re: Client Certificates Issue
    ... "Active Directory User Objects" where the certificate is available, ... the Store Name for that store or, how can I access it using C#.Net code? ... not on your server. ... of the private key for the certificate they provided to the server. ...
    (microsoft.public.dotnet.framework.aspnet.security)