Security Alert when accessing a https page

[Former Member]

Hi all,

I have configured SSL to the JAVA system. I got the digitally sigend certificate from the MS Certification Authority.I imported the certificate and the root certificate to the key-storage after to a new entry in the service-ssl view.

I stopped and started the Key-storage and SSl provider services.

I am able to browse the portal via SSL but I get a Security alert which says " the certificate is issued by a company you have not chosen to trust"And there is a red mark in the certificate which says " certificate cannot be verified up to a trusted certification authority"

I have imported the root certificate also to the JAVA visual administrator then why am i getting this security alert.?

Also I dont get this alert only if I download the root certificate to the browser's certificateion store.

Is there a way through which I can get rid of this message without downloading the root certificate to each and every client browsers Certificate store.

[MarcelRabe]

Hi,

One way to add your own MS Certification Authority (I'm assuming you have insstalled a local certificate server which and that you are not using a cerfitifcate from a real trusted root CA) into the browsers is via policies in the network logon. But this of course requires that every client is part of your Windows domain.

Marcel

[Former Member]

Hi Marcel,

Thanks a lot for the quick response.

Yes that could be a way. also I have found scripts which when run will install the certificate on the clients.

I have imported the root certificate directly to the JAVA system then why is it still throwing the error security warning.

so does it mean there is no way by which we can eliminate this security warning by installing the root certificate in one central point or server.

Thanks

Priya

[MarcelRabe]

Hi Priya

as far as i know not. The list of trusted root CA's is filled by the browser suppliers with CA's that they trust. Any other CA's you will have to import manually or via scripts/

Marcel

[Wolfgang_Janzen]

The <b>root certificate</b> need to be present (i.e. in the local keystore) at the SSL client (here: the web browser); the SSL client <u>must not</u> trust the SSL server (even if the SSL server would provide the root certificate in the https response during the SSL handshake).

Most web browsers are shipped with a bunch of root certificates (and intermediate certificates) to simplify the initial setup. If you operate your own CA then definetly the corresponding root certiticate is not present in the web browser's keystore.

Cheers, Wolfgang