[SOLVED] Zimbra Certificate on IE7 and Safari

[danny.sierra@omtech.net]

Hi guys, i'm kinda lost in this certificate issue, let me tell you what happened, i create a certificate by the admin console wich is made with my organization name and my server address, the thing is every time i access to zimbra using either safari or ie7 y got a message that says that my certificate was not issued by a trusted certification entity, yes well i generated on my zimbra server, i got that clear, but what i wanto to know if this is normal or i missconfigurate something on the certificate, and also if there is a way to avoid this messages on my clients, thanks any help as i said i not a certificate expert, so i might made a mistake, thanks

[danny.sierra@omtech.net]

sorry i forgot i got a zimbra 5.0.4 on a suse 10.1 thanx

[mmorse]

> Certificates for newbies?

[danny.sierra@omtech.net]

Thanks a lot mmorse it solve my doubts about it

[Bill Brock]

For Internet Explorer, if you will make a copy of the ca.pem file found in the /opt/zimbra/conf/ca directory then rename it to ca.cer and give it to your users that use Internet Explorer, they can right click on the file and have Windows install the certificate. It will put it in the root certificate store on their computer and IE will no longer give them the certificate error since this is the CA that issued all of your Zimbra certificates.

I simply e-mailed it as an attachment to my IE users.

[tctc]

I tried this but it doesn't work for us and our self-signed certifcate. Could it be because I have a DNS alias for my email server, i.e. server name is ms1.x.org and an alias zmail.x.org (user accounts are user@x.org). If I import the certificate into IE7 it lists the server name as ms1.x.org. Is there a way to generate an additional cert for the alias zmail.x.org? Or is there a better way? My users do not like the annoying security messages in IE7 and I really don't want to them to be trained to ignore security warnings in general!

[Bill Brock]

I'm not sure if that is what the "Subject Alternative Name" field is for when you generate a new certificate or not. It would be worth looking at.

I'm pretty sure alias name is your issue, though.

[sandorphx]

Yes, each host must be added in Subject Alt Names field. Once you do that and import ca.cer as indicated above, you should be golden. I just did that with my setup and it worked great. So, my new certificate's Subject Alternate Name includes the DNS aliases I set up for my mail server and I imported the ca.cer into Windows by right-clicking the file and choosing "Install certificate". Outlook and IE are both happier on that Windows machine now.

[rmvg]

Tried the ca.pem to ca.cert and install to windows technique, but i still get the same ie cert errors. Might be the alias thing as well, but i am unclear as to how to add hostnames to the cert, can anyone point me in the right direction?