4

I have generated a self-signed certificate authority using mydomain.org as the common name. I imported the public certificate using Thunderbird's certificate manager under the "Authorities" tab. So far so good.

Next, using this CA, I have generated (and signed) a certificate for mail.mydomain.org, but even though I imported the CA, I keep getting the "Add Security Exception" popup with the message "Unknown Identity" when I'm trying to connect for the first time. Here's a screenshot that illustrates the situation:

popup, mail certificate, authorities, trust, CA

Note: Both the CA and the mail certificate are signed using "SHA-1 With RSA Encryption".
Note 2: I understand that I should get a certificate from a trusted authority, this is a temporary solution.

So my questions are:

1) Is this behavior normal?
2) How do I "convince" Thunderbird that all certificates signed by my CA are trusted?

UPDATE

% openssl s_client -connect mail.mydomain.org:993
CONNECTED(00000003)
depth=1 <snip> CN = mydomain.org, <snip>
verify error:num=19:self signed certificate in certificate chain
verify return:0
---
Certificate chain
 0 s:/<snip>/CN=mail.mydomain.org/<snip>
   i:/<snip>/CN=mydomain.org/<snip>
 1 s:/<snip>/CN=mydomain.org/<snip>
   i:/<snip>/CN=mydomain.org/<snip>
---
Server certificate
-----BEGIN CERTIFICATE-----
<BASE64>
-----END CERTIFICATE-----
subject=/<snip>/CN=mail.mydomain.org/<snip>
issuer=/<snip>/CN=mydomain.org/<snip>
---
No client certificate CA names sent
---
SSL handshake has read 2807 bytes and written 567 bytes
---
New, TLSv1/SSLv3, Cipher is AES256-SHA
<long apparently irrelevant output snipped>
    Verify return code: 19 (self signed certificate in certificate chain)
---
* OK [CAPABILITY IMAP4rev1 UIDPLUS CHILDREN NAMESPACE THREAD=ORDEREDSUBJECT THREAD=REFERENCES SORT QUOTA IDLE AUTH=PLAIN ACL ACL2=UNION] Courier-IMAP ready. Copyright 1998-2011 Double Precision, Inc.  See COPYING for distribution information.
  • You need to show us the host certificate as well. – MikeyB Aug 20 '13 at 1:16
  • Do you have put your CA certificate in your server ? If it is dovecot, you should add the CA cert to your server cert file to provide it to the client. – Dom Aug 20 '13 at 6:47
  • 1
    @MikeyB, the 3 rightmost windows are describing the CA. – s3v3n Aug 20 '13 at 8:12
  • @Dom, of course I did. It's courier, the 2 leftmost windows are describing the certificate received via imap-ssl – s3v3n Aug 20 '13 at 8:21
  • 1
    'openssl s_client -connect server:port' and see if there is an error like 'unable to get local issuer certificate' – Dom Aug 20 '13 at 12:31
3
  1. In Mozilla Thunderbird, go to Tools → Options → Advanced → tab Certificates.
  2. Click on View Certificates and go to tab Servers.
  3. Click on Add Exception.
  4. Enter the name of your mail server and click on Get Certificate.
    Do not forget to use the port number of the mail server.
    Example: mail.provider.com:993
  5. Save the exception.

Source: http://kb.kerio.com/product/kerio-connect/server-configuration/ssl-certificates/self-signed-certificates-in-mozilla-thunderbird-950.html

1

I had the same problem. The source in my case was the CA was not created with -extensions v3_ca which Firefox does not care about but Thunderbird seems to require for a "valid" signature

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.