Security Warning: The Server you are connected to is using a security certificate that cannot be verified. The Target principal name is incorrect

Question

I'm trying to get my mails using Outlook 2007 and POP3 using SSL but I get this security warning every time I try to receive mails:

The Server you are connected to is using a security certificate that cannot be verified. The Target principal name is incorrect.

When I open the certificate I see this message in the first tab (General):

All the intended purposes of this certificate could not be verified.

Issued by: GeoTrust SSL CA
Issued to: *.justhost.com

which is one of the trusted providers.

Do you think it's a man in the middle attack or a security risk? Or is it just a kind of a certificate error that I can ignore?

Answer 1

justhost is a hosting service provider and if you/your company host your mail services on their non-dedicated servers, this umbrella wildcard certificate will be used to secure the connection.

There's a limitation in SSL/TLS that the host name the client is connecting to is not revealed to the server until a secure socket has been established. This means the server must blindly supply a default certificate which is the "*.justhost.com" you saw.

Thus if you access the mail server through your company's alias domain, e.g. mail.company.com, a certificate subject mismatch will occur. You could use the following steps to find the correct domain to use:

1. ping your mail server to get its IP address
2. Use nslookup or whois to get the host name of the server. The host name should end with "justhost.com", which is covered by the wildcard certificate.
3. Replace the POP/IMAP server and SMTP server address with the host name in Outlook

Answer 2

First of all update your operating system CRL's (Certificate Revocation Lists), there have been so many hacked CA's lately.

The name of the host is the same as the name certified. If it is a subdomain the certificate should be issued for that subdomain, or be valid domain wide. Check the intended purposes of the certificate it could not be issued to cipher your pop3 connections (note that it is effectively ciphering them though).

I would check the name of the certified domain if it's a trusted one, then it is unlikely that those errors pose a security risk.

Answer 3

I'd say you should not ignore the warning but rather contact server support and ask what's up. "The Target principal name is incorrect" message can mean that host A.com sends server certificate issued to "B.com". This is a common configuration problem when multiple hosts are managed (code.google.com has the same problem), so it's possible that there's no security issue here. Yet to be sure (especially if you live in the country with limited freedoms) you should not assume everything is fine until you get comments from server admins.