Trusting Certs from Non Trusted root

Trusting Certs from Non Trusted root
Secure Home | Search | About
Login Password
Register Now! Lost Password?
 Microsoft Applications Security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
Trusting Certs from Non Trusted root TrevorJ 03-23-2007
Posted by S. Pidgorny on March 24, 2007, 9:26 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
G'day:

"Lanwench [MVP - Exchange]"

> Although I have the utmost respect for Mr. Pidgorny, I can't agree with
> the blanket statement that "...the IT people are very unprofessional"
> with so little background knowlege. To give them the benefit of the
> doubt, perhaps they've been given a shoestring budget and/or have
> technologically-challenged management to deal with - either might explain
> why they went with the "roll your own" route.

It's okay for them to use free certificate and not to spend on that; it is
not okay to suggest that "it's just one click" - instead, they should make
their root CA cert available and provide instructions on how to make it
trusted. Shoestring budget isn't a good excuse for not even trying a better
customer service.

--
Svyatoslav Pidgorny, MS MVP - Security, MCSE
-= F1 is the key =-

* http://sl.mvps.org * http://msmvps.com/blogs/sp *



Posted by Kerry Brown on March 24, 2007, 1:30 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Here's the procedure to import the certificate.

1> Run IE as an administrator (Right-click the desktop icon)
2> Visit the site.
3> Click through the certificate error
4> Click the "Certificate Error" button in the address bar.
5> Click View Certificate
6> Click Install Certificate
7> Unlike on XP, you must click the “Place all certificates in the
following store” radio button, and choose the “Trusted Root Certification
Authorities” store. If you don’t do this, the certificate goes in your
personal store, and it isn’t trusted by IE.

Thanks to ericlaw from this thread.

http://channel9.msdn.com/ShowPost.aspx?PostID=238140

--
Kerry Brown
Microsoft MVP - Shell/User
http://www.vistahelp.ca


>I work for a school which has internet access to the school network via a
> https address. When connecting IE produces the following message: "The
> security certificate presented by this website was not issued by a trusted
> certificate authority." Although the certificate cannot be traced back, I
> would like to avoid this message every time I log on. I have tried
> importing
> the certificate and placing he site into my 'trusted sites' area, but to
> no
> avail. Is there a way of achieving what I want to do?
> TIA. Trevor
>


Posted by S. Pidgorny on March 24, 2007, 9:37 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Kerry,

In this particular case (https://24hrschool.bexhillhigh.e-sussex.sch.uk/)
that doesn't seem to work. The issue is - the certificate isn't self-signed
(the subject CN doesn't match the issuer CN), nor the root is available. The
certificate hierarchy is broken, and it's only up to the "IT people" to fix
that.

--
Svyatoslav Pidgorny, MS MVP - Security, MCSE
-= F1 is the key =-

* http://sl.mvps.org * http://msmvps.com/blogs/sp *


> Here's the procedure to import the certificate.
>
> 1> Run IE as an administrator (Right-click the desktop icon)
> 2> Visit the site.
> 3> Click through the certificate error
> 4> Click the "Certificate Error" button in the address bar.
> 5> Click View Certificate
> 6> Click Install Certificate
> 7> Unlike on XP, you must click the "Place all certificates in the
> following store" radio button, and choose the "Trusted Root Certification
> Authorities" store. If you don't do this, the certificate goes in your
> personal store, and it isn't trusted by IE.
>
> Thanks to ericlaw from this thread.
>
> http://channel9.msdn.com/ShowPost.aspx?PostID=238140
>
> --
> Kerry Brown
> Microsoft MVP - Shell/User
> http://www.vistahelp.ca
>
>
>>I work for a school which has internet access to the school network via a
>> https address. When connecting IE produces the following message: "The
>> security certificate presented by this website was not issued by a
>> trusted
>> certificate authority." Although the certificate cannot be traced back, I
>> would like to avoid this message every time I log on. I have tried
>> importing
>> the certificate and placing he site into my 'trusted sites' area, but to
>> no
>> avail. Is there a way of achieving what I want to do?
>> TIA. Trevor
>>
>



Posted by Kerry Brown on March 24, 2007, 11:15 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
You're correct. I thought it would work but never tested it. It doesn't
work.

--
Kerry Brown
Microsoft MVP - Shell/User
http://www.vistahelp.ca


> Kerry,
>
> In this particular case (https://24hrschool.bexhillhigh.e-sussex.sch.uk/)
> that doesn't seem to work. The issue is - the certificate isn't
> self-signed (the subject CN doesn't match the issuer CN), nor the root is
> available. The certificate hierarchy is broken, and it's only up to the
> "IT people" to fix that.
>
> --
> Svyatoslav Pidgorny, MS MVP - Security, MCSE
> -= F1 is the key =-
>
> * http://sl.mvps.org * http://msmvps.com/blogs/sp *
>
>
>> Here's the procedure to import the certificate.
>>
>> 1> Run IE as an administrator (Right-click the desktop icon)
>> 2> Visit the site.
>> 3> Click through the certificate error
>> 4> Click the "Certificate Error" button in the address bar.
>> 5> Click View Certificate
>> 6> Click Install Certificate
>> 7> Unlike on XP, you must click the "Place all certificates in the
>> following store" radio button, and choose the "Trusted Root Certification
>> Authorities" store. If you don't do this, the certificate goes in your
>> personal store, and it isn't trusted by IE.
>>
>> Thanks to ericlaw from this thread.
>>
>> http://channel9.msdn.com/ShowPost.aspx?PostID=238140
>>
>> --
>> Kerry Brown
>> Microsoft MVP - Shell/User
>> http://www.vistahelp.ca
>>
>>
>>>I work for a school which has internet access to the school network via a
>>> https address. When connecting IE produces the following message: "The
>>> security certificate presented by this website was not issued by a
>>> trusted
>>> certificate authority." Although the certificate cannot be traced back,
>>> I
>>> would like to avoid this message every time I log on. I have tried
>>> importing
>>> the certificate and placing he site into my 'trusted sites' area, but to
>>> no
>>> avail. Is there a way of achieving what I want to do?
>>> TIA. Trevor
>>>
>>
>
>


Posted by =?Utf-8?B?VHJldm9ySg==?= on March 27, 2007, 7:55 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Slavic. As you may have gathered, I am a bit of an ignoramus on things
encription/certificates. When I looked at the cert, it was issued to:
24hrSchool... by: ClassServer. Is this what the problem is?
When you talk about CA and CN, I don't know what these abbreviations mean
so am at a bit of a los to understand these things.
I agree with your other post .....'instead, they should make
their root CA cert available and provide instructions on how to make it
trusted.' and if I could find out how this is done, there is a possibility
that I might be able to persuade them to do this.



"S. Pidgorny <MVP>" wrote:

> Kerry,
>
> In this particular case (https://24hrschool.bexhillhigh.e-sussex.sch.uk/)
> that doesn't seem to work. The issue is - the certificate isn't self-signed
> (the subject CN doesn't match the issuer CN), nor the root is available. The
> certificate hierarchy is broken, and it's only up to the "IT people" to fix
> that.
>
> --
> Svyatoslav Pidgorny, MS MVP - Security, MCSE
> -= F1 is the key =-
>
> * http://sl.mvps.org * http://msmvps.com/blogs/sp *
>
>
> > Here's the procedure to import the certificate.
> >
> > 1> Run IE as an administrator (Right-click the desktop icon)
> > 2> Visit the site.
> > 3> Click through the certificate error
> > 4> Click the "Certificate Error" button in the address bar.
> > 5> Click View Certificate
> > 6> Click Install Certificate
> > 7> Unlike on XP, you must click the "Place all certificates in the
> > following store" radio button, and choose the "Trusted Root Certification
> > Authorities" store. If you don't do this, the certificate goes in your
> > personal store, and it isn't trusted by IE.
> >
> > Thanks to ericlaw from this thread.
> >
> > http://channel9.msdn.com/ShowPost.aspx?PostID=238140
> >
> > --
> > Kerry Brown
> > Microsoft MVP - Shell/User
> > http://www.vistahelp.ca
> >
> >
> >>I work for a school which has internet access to the school network via a
> >> https address. When connecting IE produces the following message: "The
> >> security certificate presented by this website was not issued by a
> >> trusted
> >> certificate authority." Although the certificate cannot be traced back, I
> >> would like to avoid this message every time I log on. I have tried
> >> importing
> >> the certificate and placing he site into my 'trusted sites' area, but to
> >> no
> >> avail. Is there a way of achieving what I want to do?
> >> TIA. Trevor
> >>
> >
>
>
>

Similar ThreadsPosted
Clients no longer pick up the Root CA as a trusted root authority June 6, 2006, 6:59 pm
Options for Deploying Root and Int Certs to clients not part of do April 29, 2007, 1:50 pm
Updating Trusted Root CA May 6, 2008, 4:31 pm
shutting down a trusted CA and raising a new trusted CA July 14, 2005, 1:32 pm
Convert Enterprise Root CA to Standalone Root CA and create new Subordinate CAs March 19, 2008, 1:45 am
Migrating from single enterprise root CA to different root CA May 11, 2007, 6:43 am
PKI question, trusting subordinate CA January 1, 2006, 4:24 am
How do I delete my old ca certs... February 19, 2008, 10:45 am
Digital certs June 13, 2008, 11:17 am
subordinate ent CAs don't publish certs to AD after Win 2k3 SP1 July 23, 2005, 1:00 pm

The site map in XML format XML site map

Contact Us | Privacy Policy