How can I get Thunderbird to import a secure LDAP certificate?

Question

I've got an LDAP server configured for in Thunderbird's address book (ldap.example.com). I'd like to use the SSL version, so I checked the 'Use SSL' box. It starts to work, but I get a certificate warning in response. Okay, sure, I know that server uses a funny certificate, so I'll add it.

I found the 'Add Security Exception' box readily enough, and it asks me for a server location. But I don't know what to put in there. The dialog box starts with https:// in it, but https://ldap.example.com doesn't work, and neither does anything like imaps:// or ldap:// or ldaps:// (is that a real protocol name? well, I tried it). LDAP really is the only service this server provides.

How can I get Thunderbird to read the certificate?

Answer 1

The Mozilla Knowledge Base priovides instructions on what to do if a certificate is not trusted by Thunderbird. You will need a DER encoded .cer file to import, or if you can get Internet Explorer(Windows only obviously) to accept the certificate, the KB has instructions on how to export one.

1. ...go to "Tools -> Options -> Advanced -> Certificates -> Manage Certificates... -> Authorities". (In Mozilla Suite, go to "Edit -> Preferences -> Privacy & Security -> Certificates -> Manage Certificates... -> Authorities".)
2. Select "Import", select the file you saved above, and click "Open".
3. Read the warning and select for what purpose you trust the certificate.
4. Click "OK" if you trust it. It should now be installed.

Answer 2

In subsequent exploration I discovered that you can simply provide the URL https://ldap.example.com:636 (636 being the SSL+LDAP port) and Thunderbird will do the SSL negotation necessary to get the certificate, drop the connection, and never realize that it's not actually talking HTTP.

I'm going to file something with the Thunderbird bug tracker suggesting they take ldaps:// as a protocol specifier, instead of using that silly hack.