Solved

certification authority

Posted on 2004-04-13
9
28,809 Views
Last Modified: 2012-05-04
I am having an issue with my server certificate, I installed CA service so that I can make and issue my server certificate.  I followed the instructions as per Microsoft’s website and all seems well from the server at least

Now when I have another box (not the server) connects to my web site: example: http://whatever.domain.com/. They get a “Security Alert” no problem there I guess.
It has a message that says:
“The server certificate was issues by a company you have not chosen to trust. View the certificate to determine whether you want to trust the certifying authority.”

Then at the end when it asks me if I want to proceed I have the options of ‘yes’, ‘no’, ‘view certificate’

When viewing the certificate in the General Tab it reads:
This certificate cannot be verified up to a trusted certification authority.
In the Certification Path is says all is OK.

I don’t know why this is happening because my server that also has the web server on it is the “certification authority”.

Also even when I install the certificate and revisit the site I get that pop up prompt

So… to make a long story short, I need some help (hand holding  ... walk through type of help).

I need to get this working in less than 8 hrs.
0
Comment
Question by:weguardyou
  • 3
  • 2
  • 2
  • +2
9 Comments
 
LVL 2

Expert Comment

by:JaniceLaw
Comment Utility
The problem you are having is the CA itself is not trusted by the web browser. What you have at the moment is a self-signing certificate. Basically, you are telling the web browser to trust you because you trust yourself. For solutions, look at the question below.

http://www.experts-exchange.com/Networking/Q_20950930.html
0
 
LVL 1

Author Comment

by:weguardyou
Comment Utility
Well that doesnt do it for me.  you see even when i test with my remote clients and install my certificate into their browser manually.
When i close out and revisit the site.  The same thig happens.  I get that pop/up again.
0
 
LVL 2

Expert Comment

by:JaniceLaw
Comment Utility
Can you check something for me? After you install the certificate, double click on the lock icon and tell me what you find in the Certification Path. Also select the root entry and click on view certificate and what you have showing under the general tab.
0
 
LVL 23

Accepted Solution

by:
Tim Holman earned 500 total points
Comment Utility
>When viewing the certificate in the General Tab it reads:
>This certificate cannot be verified up to a trusted certification authority.
>In the Certification Path is says all is OK.

This means that your certificate isn't trusted by any of the authorities that appear under this section of the web browser:

Tools > Internet Options > Content > Certificates

..this is normal behaviour, as your self-signed certificate has not been approved by higher sentient beings yet.  As soon as you get a proper server certificate from somewhere like Verisign, this will continue to be an issue.
Nonetheless, your SSL session is still safe and encrypted as long as you don't go giving away your keys to anyone !


0
Maximize Your Threat Intelligence Reporting

Reporting is one of the most important and least talked about aspects of a world-class threat intelligence program. Here’s how to do it right.

 
LVL 1

Author Comment

by:weguardyou
Comment Utility
Yes, I understand that now.  But my thing is this:  Even when a person on a remote system installs the certificate to their browser. And later on revisit the site, they again receive that message popup.  Is that normal?  In my thinking I was under the impression that it would no longer pop up that message.
0
 
LVL 23

Expert Comment

by:Tim Holman
Comment Utility
Yes, this is normal.
I believe you can change this default behaviour by altering IE advanced settings, but then this isn't what 'the masses' should be expected to do just to be able to view your website, so again your forced down the valid, trusted certificate route...

IE > Tools > Internet Options > Advanced - 'warn about invalid site certificates'
0
 
LVL 3

Expert Comment

by:jermsmit
Comment Utility
One solution is to get a cert from a root authority, this should allow you to give out certificates under your name to others and they will be valid due to a trust relationship.
 
0
 
LVL 23

Expert Comment

by:Tim Holman
Comment Utility
Any reason this last comment was accepted as an answer ??  
0
 

Expert Comment

by:huntermis
Comment Utility
It's funny that the FireFox browser will install the certifiicate and will not prompt you again upon returning to the site while IE forces you to click "yes".  They don't even give you the opportunity to add the CA as a trusted source.  I guess I will have to spend a little dough.
0

Featured Post

What Is Threat Intelligence?

Threat intelligence is often discussed, but rarely understood. Starting with a precise definition, along with clear business goals, is essential.

Join & Write a Comment

Many companies are looking to get out of the datacenter business and to services like Microsoft Azure to provide Infrastructure as a Service (IaaS) solutions for legacy client server workloads, rather than continuing to make capital investments in h…
Find out what Office 365 Transport Rules are, how they work and their limitations managing Office 365 signatures.
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, Just open a new email message.  In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…
Internet Business Fax to Email Made Easy - With eFax Corporate (http://www.enterprise.efax.com), you'll receive a dedicated online fax number, which is used the same way as a typical analog fax number. You'll receive secure faxes in your email, fr…

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

6 Experts available now in Live!

Get 1:1 Help Now