Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm trying to get my mails using Outlook 2007 and POP3 using SSL but I get this security warning every time I try to receive mails:

The Server you are connected to is using a security certificate that cannot be verified. The Target principal name is incorrect.

When I open the certificate I see this message in the first tab (General):

All the intended purposes of this certificate could not be verified.

Issued by: GeoTrust SSL CA
Issued to: *.justhost.com

which is one of the trusted providers.

Do you think it's a man in the middle attack or a security risk? Or is it just a kind of a certificate error that I can ignore?

share|improve this question

migrated from stackoverflow.com Sep 2 '11 at 10:46

This question came from our site for professional and enthusiast programmers.

3 Answers 3

up vote 3 down vote accepted

justhost is a hosting service provider and if you/your company host your mail services on their non-dedicated servers, this umbrella wildcard certificate will be used to secure the connection.

There's a limitation in SSL/TLS that the host name the client is connecting to is not revealed to the server until a secure socket has been established. This means the server must blindly supply a default certificate which is the "*.justhost.com" you saw.

Thus if you access the mail server through your company's alias domain, e.g. mail.company.com, a certificate subject mismatch will occur. You could use the following steps to find the correct domain to use:

  1. ping your mail server to get its IP address
  2. Use nslookup or whois to get the host name of the server. The host name should end with "justhost.com", which is covered by the wildcard certificate.
  3. Replace the POP/IMAP server and SMTP server address with the host name in Outlook
share|improve this answer

First of all update your operating system CRL's (Certificate Revocation Lists), there have been so many hacked CA's lately.

The name of the host is the same as the name certified. If it is a subdomain the certificate should be issued for that subdomain, or be valid domain wide. Check the intended purposes of the certificate it could not be issued to cipher your pop3 connections (note that it is effectively ciphering them though).

I would check the name of the certified domain if it's a trusted one, then it is unlikely that those errors pose a security risk.

share|improve this answer

I'd say you should not ignore the warning but rather contact server support and ask what's up. "The Target principal name is incorrect" message can mean that host A.com sends server certificate issued to "B.com". This is a common configuration problem when multiple hosts are managed (code.google.com has the same problem), so it's possible that there's no security issue here. Yet to be sure (especially if you live in the country with limited freedoms) you should not assume everything is fine until you get comments from server admins.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.