Re: Root Certificate
- From: "Nathan Herring [MSFT]" <nathanh@xxxxxxxxxxxxxxxxxxxx>
- Date: Mon, 23 Jan 2006 18:19:51 -0800
More specifically, the rules are that:
1) You must match the common name in the subject name <OR> you must match a
FQDN or IP address found in a subject alternative name extension.
2) If you have a critical Extended Key Usage ( 2 5 29 37 ) extension, then
it must list Server Authentication ( 1 3 6 1 5 5 7 3 1 ) as one of its
purposes.
Given that, we don't have support for comparing IP addresses in subject
alternative names. (Yet.) We also have some issues about reporting what kind
of certificate error it was.
We have a few issues with parsing some certificates and verifying these
rules that have been corrected and will be available in an upcoming release.
I highly suggest taking up the issue with your IT administrator. They should
be issuing correct certificates. They can use the "*.foo.com" syntax to be
able to match all the hosts in the foo.com domain (though not "a.b.foo.com",
for which it would need "*.*.foo.com").
-nh
On 1/20/06 12:15:56 AM, in article BFF64CBD.14C5B2%chrisridd@xxxxxxx, "Chris
Ridd" <chrisridd@xxxxxxx> wrote:
> On 19/1/06 11:40, in article BFF57F8F.69F2%kledgister@xxxxxxxxxxxx, "Kevin
> Ledgister" <kledgister@xxxxxxxxxxxx> wrote:
>
>> I've tried the Mac Help Desk instructions but I still get the same root
>> certificate is not installed issue and Entourage won't connect to Exchange.
>>
>> Our IT admin created a *.crt certificate from the Exchange server but it has
>> a host name mismatch.
>>
>> Would a host name mismatch in the certificate terminally affect Entourage to
>> connect to Exchange 2003?
>
> Using SSL *requires* that the name the client uses to contact the server
> exactly matches the name in the server's certificate.
>
> If your "IT admin" has screwed up this basic stuff, just tell Entourage to
> contact the broken name, and then hardwire this broken name in your
> /etc/hosts file.
>
> In more detail:
>
> Say you are currently talking to "exchange.example.com" and your "IT admin"
> has used the name "broken-name.microsoft.com" in the certificate.
>
> 1) Use the Lookup tab in Network Utility.app to find the IP address for
> exchange.example.com. Say it returns 1.2.3.4...
>
> 2) In Terminal.app, type:
>
> sudo -s
> echo "1.2.3.4 broken-name.microsoft.com" >> /etc/hosts
> exit
>
> 3) Restart Entourage.
>
> Cheers,
>
> Chris
>
--
Nathan Herring
MacBU SDE/Development
This posting is provided ³AS IS² with no warranties, and confers no rights.
.
- Follow-Ups:
- Re: Root Certificate
- From: Chris Ridd
- Re: Root Certificate
- References:
- Root Certificate
- From: Kevin Ledgister
- Re: Root Certificate
- From: Chris Ridd
- Root Certificate
- Prev by Date: Re: error -4960
- Next by Date: Re: ldap only certain results
- Previous by thread: Re: Root Certificate
- Next by thread: Re: Root Certificate
- Index(es):
Relevant Pages
|
