I have generated a self-signed certificate authority using mydomain.org as the common name. I imported the public certificate using Thunderbird's certificate manager under the "Authorities" tab. So far so good.
Next, using this CA, I have generated (and signed) a certificate for mail.mydomain.org, but even though I imported the CA, I keep getting the "Add Security Exception" popup with the message "Unknown Identity" when I'm trying to connect for the first time. Here's a screenshot that illustrates the situation:
Note: Both the CA and the mail certificate are signed using "SHA-1 With RSA Encryption".
Note 2: I understand that I should get a certificate from a trusted authority, this is a temporary solution.
So my questions are:
1) Is this behavior normal?
2) How do I "convince" Thunderbird that all certificates signed by my CA are trusted?
% openssl s_client -connect mail.mydomain.org:993 CONNECTED(00000003) depth=1 <snip> CN = mydomain.org, <snip> verify error:num=19:self signed certificate in certificate chain verify return:0 --- Certificate chain 0 s:/<snip>/CN=mail.mydomain.org/<snip> i:/<snip>/CN=mydomain.org/<snip> 1 s:/<snip>/CN=mydomain.org/<snip> i:/<snip>/CN=mydomain.org/<snip> --- Server certificate -----BEGIN CERTIFICATE----- <BASE64> -----END CERTIFICATE----- subject=/<snip>/CN=mail.mydomain.org/<snip> issuer=/<snip>/CN=mydomain.org/<snip> --- No client certificate CA names sent --- SSL handshake has read 2807 bytes and written 567 bytes --- New, TLSv1/SSLv3, Cipher is AES256-SHA <long apparently irrelevant output snipped> Verify return code: 19 (self signed certificate in certificate chain) --- * OK [CAPABILITY IMAP4rev1 UIDPLUS CHILDREN NAMESPACE THREAD=ORDEREDSUBJECT THREAD=REFERENCES SORT QUOTA IDLE AUTH=PLAIN ACL ACL2=UNION] Courier-IMAP ready. Copyright 1998-2011 Double Precision, Inc. See COPYING for distribution information.