topic Security Alert when accessing a https page in Application Development and Automation Discussions

Security Alert when accessing a https page

Former Member — Mon, 13 Nov 2006 10:11:56 GMT

Hi all,

I have configured SSL to the JAVA system. I got the digitally sigend certificate from the MS Certification Authority.I imported the certificate and the root certificate to the key-storage after to a new entry in the service-ssl view.

I stopped and started the Key-storage and SSl provider services.

I am able to browse the portal via SSL but I get a Security alert which says " the certificate is issued by a company you have not chosen to trust"And there is a red mark in the certificate which says " certificate cannot be verified up to a trusted certification authority"

I have imported the root certificate also to the JAVA visual administrator then why am i getting this security alert.?

Also I dont get this alert only if I download the root certificate to the browser's certificateion store.

Is there a way through which I can get rid of this message without downloading the root certificate to each and every client browsers Certificate store.

Re: Security Alert when accessing a https page

MarcelRabe — Mon, 13 Nov 2006 10:39:34 GMT

Hi,

One way to add your own MS Certification Authority (I'm assuming you have insstalled a local certificate server which and that you are not using a cerfitifcate from a real trusted root CA) into the browsers is via policies in the network logon. But this of course requires that every client is part of your Windows domain.

Marcel

Re: Security Alert when accessing a https page

Former Member — Mon, 13 Nov 2006 11:03:03 GMT

Hi Marcel,

Thanks a lot for the quick response.

Yes that could be a way. also I have found scripts which when run will install the certificate on the clients.

I have imported the root certificate directly to the JAVA system then why is it still throwing the error security warning.

so does it mean there is no way by which we can eliminate this security warning by installing the root certificate in one central point or server.

Thanks

Priya

Re: Security Alert when accessing a https page

MarcelRabe — Mon, 13 Nov 2006 11:43:46 GMT

Hi Priya

as far as i know not. The list of trusted root CA's is filled by the browser suppliers with CA's that they trust. Any other CA's you will have to import manually or via scripts/

Marcel

Re: Security Alert when accessing a https page

Wolfgang_Janzen — Mon, 13 Nov 2006 12:21:01 GMT

The <b>root certificate</b> need to be present (i.e. in the local keystore) at the SSL client (here: the web browser); the SSL client <u>must not</u> trust the SSL server (even if the SSL server would provide the root certificate in the https response during the SSL handshake).

Most web browsers are shipped with a bunch of root certificates (and intermediate certificates) to simplify the initial setup. If you operate your own CA then definetly the corresponding root certiticate is not present in the web browser's keystore.

Cheers, Wolfgang