3

I've just switched from using unencrypted SMTP and IMAP for mail in Outlook 2010. My mail is hosted on a shared hosting setup and not my own, dedicated server.

The certificate issued by the server is self-signed. I am fine with that and I am completely aware that it is self-signed.

However, Outlook issues a warning about the certificate each time it opens.

I have tried installing the certificate, as Matthew Williams suggests in his answer, but this does not result in the warning being dismissed.

How can I permanently disable/ dismiss this warning?

1
  • 2
    Disabling warnings is never the right question or answer – it would make SSL completely useless. Making Outlook trust your certificates specifically, as the answer below suggests, is a much better idea.
    – user1686
    Jan 24 '14 at 13:27
2

You can install the certificate so it's allowed without issue. Within the security dialogue box click view certificate then install certificate. If you require assistance when setting up the certificate Microsoft provide a nice guide you can follow.

http://support.microsoft.com/kb/2006728

Hope that helps.

5
  • Thanks, Matthew. I've tried that approach, but the warning box remains. It appears that the certificate did install properly, too.
    – James
    Jan 24 '14 at 14:36
  • 1
    Hi James, Lets check through a couple steps just to make sure everything is in order. Following the steps provided I assume you have managed to get the certificate onto your email server. Now you need to open up your Outlook client and add your certification to your Trust Centre. Being a rather lengthy process I will provide a link for you if this step hasn't been done yet. support.quovadisglobal.com/KB/a101/… My apologies for not providing this. I assumed the problem was server side from your original post. Hope this help. Jan 24 '14 at 14:48
  • Hi Matthew, sorry - I've only just seen the reply you gave above. I took a look at the link you gave, but it appears it relates to signing and encrypting mail. When I do go through that process, it says that there aren't any certificates to choose from. Presumably this process won't resolve the issue of Outlook recognising the server's certificate?
    – James
    Feb 9 '14 at 3:11
  • 2
    I´m pretty sure installing the certificate wont help unless it is the root certificate from the certification authority. If you only install the server certificate it is still not possible for the computer to verify the chain of trust Jan 2 '15 at 14:01
  • @Ivan Viktorovic is correct. Sep 20 '16 at 16:27
2

To solve the problem first of all we need to know more about the error you are getting. There are three possible sources for the error you are getting. Please post a screenshot showing the error and the certificate.

  1. The mail server name e.g gmail.com doesent match the name on the certificate. You cant solve this problem and you will need to contact your provider and he needs fix this issue.

  2. The certificate is no longer valid. Every certificate has a certain time its valid and it can between 1 year up to 5. If the certificate is no longer valid you cant solve the problem (in most cases) and you will need to contact you mail provider as well to fix the problem. This error could also appear on your pc when you date and time is not set right. Check you date and time settings.

  3. The trust chain can not be established. You will get this error if your provider is using self signed certificates because its cheaper. This error you could fix if you have the root certificate from your provider. You will need to contact your provider and ask for the certificate because it is not the one you are getting when the error is displayed. This root certificate you need to install as "trusted certification certification authority". As soon as you have done this the error should disapear. Be sure that you use admin right when you install the certificate.

4
  • By 'provider' do you mean myself, as I'm hosting my own mail server? It sounds like your third situation is closest to mine.
    – James
    Jan 2 '15 at 19:08
  • Yes. Have you created the certificate by yourself? If yes on what server or pc did you create it? Usually you need a certification authority to create a certificate. This authority(computer or server) has a root certificate and this one you need to install as trusted authority on your outlook pc and then the error should disapear. Jan 2 '15 at 19:19
  • I created the certificate myself on the same server used for mail. In short, it sounds like I need a paid-for certificate, is that right?
    – James
    Jan 5 '15 at 10:39
  • 1
    No you dont need a paid certificate. You need to import the root certificate from your server(certification authority) on your pc. A paid certificate makes your life easier but you can handle the things you want with your own certificate. What operating system do you have on your server? If windows you can use this tutorial how to export the root certificate (databasemart.com/howto/SQLoverssl/…) Jan 5 '15 at 10:52
1

I now have a possible answer ;)

@James: I think you haven't supplied enough info actually. But here is what I think might be wrong and how to fix it.

I suspect your Hosting provider is running some sort of Open-Source Mail Server. Probably Postfix (Not Exchange).

Your Hosting Company probably has a single certificate for their mail server and it's issued to the FQDN of their mail server. So, when you view the certificate, the Issued To field should contain the FQDN of the mail server (and Issued By will probably be the same). Since you are using TLS, Outlook compares the certificate's information to the information you have in your Account Settings (ie mail server name). If there's a mismatch, you get a warning (regardless of whether the certificate has been installed or not).

So, to make the warning go away, you have to do the following:

1) If the Issued To name does not match the FQDN of the hosting company's server, you have to alert them of the problem. (Don't bother asking them to create a certificate for your mail server domain as it's not that simple. see below)

2) You have to change the mail server name in your Outlook Account settings to match the FQDN stated in the certificate. Ie. you have to use your hosting provider's FQDN as the mail server address (You can't use your own domain name with TLS like you did when it was unencrypted.) For your account name, you should have the full email address (eg you@yourdomain.tld).

Anything else there will cause you problems.

In your case
Since you created your own certificate, you just need to create a new certificate with the right info in the Common Name field. When you are filling in that field, put the FQDN of your mail server in, ie hostname.domain.tld. Then, in your Outlook Account settings, make sure you have matching server name settings for POP3/IMAP and SMTP.

Example
Certificate:
hostname = myserver
domain = mydomain.int (I use tld = int for internal domains I develop/test with)
Common Name = myserver.mydomain.int
Outlook:
POP3/IMAP = myserver.mydomain.int
SMTP = myserver.mydomain.int

The first time you access the server, Outlook will give you the pop-up. View the certificate and on the Details tab, Copy to File. This will bring up a Wizard to export the certificate. Then, you need to type certmgr.msc into the Start Menu search box and import the certificate into the Trusted Root Root Certification Authorities list.

I don't believe Ivan's 3rd diagnosis is correct. The certificate that is displayed in the pop-up window is the Public Key and is what you need. You DO NOT need, and the provider WILL NOT give you their private key. I think his 1st option is what is causing the problem.

Even though your the POP3/IMAP and SMTP server name settings in Outlook aren't your own domain, you can still send mail using your domain name and receive mail with your domain name because the username carries the required info. It's only the connection to the server that is the issue here.

The reason this problem exists is because Postfix does not support SNI, so you can only have one SSL certificate for the server, and the hoster's FQDN is the most logical.

Dovecot does support SNI, and I'm going to have a look at how to go about setting it up, but this is not very easy for a hosting company to do and by default, it's not available.

This problem was more difficult for me to narrow down because my iPhone and Thunderbird on both Ubuntu & OSX accept my certificate once I acknowledge that I trust it. They don't seem to mind the difference in the naming convention. But Windows and Outlook 2007 are more fussy about having it right.

Hope this helps.

(I still can't make comments :( AAAARRRRRRGGGGG)

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.