Subject: Dummy SSL Certs and W32/Internet Explorer

From: "Drew J. Como" <[email-masked]>
Date: Wed, 24 Apr 2002 21:41:25 -0400

All,

I have just installed mod_ssl-2.8.7 with Apache 1.3.23
on my SuSE system.  Everything built ok, but the problem
that I am having is when I am using 'dummy' or fake certificates.

My Netscape/Mozilla users can easily accept and save the dummy certificates
(the first time to the site) and then on each visit to the SSL-enabled site, 
it doesn't prompt them to accept the cert since it is saved.

However, (there's always one), Internet Explorer accepts the certificate
and you can even 'import' it into your program, (It even shows in the
list), but if you close the browser and then go back to the SSL-enabled site,
it asks you to save the cert once again, just like it did the first time.

Is this a browser bug, an unset-setting, or just MS thinking for us
again?

Any help would be greatly appreciated!!

============================================
Drew J. Como             Phone: 631-434-6600
Systems Administrator      Fax: 631-434-7800
[email-masked]         Web: www.bascom.com
    Bascom Global Internet Services, Inc.
--------------------------------------------
          "When quality is the goal, 
           winning is guaranteed." 

______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: "Aryeh Katz" <[email-masked]>
Date: Thu, 25 Apr 2002 09:24:57 -0400

> My Netscape/Mozilla users can easily accept and save the dummy
> certificates (the first time to the site) and then on each visit to
> the SSL-enabled site, it doesn't prompt them to accept the cert since
> it is saved.
> 
> However, (there's always one), Internet Explorer accepts the
> certificate and you can even 'import' it into your program, (It even
> shows in the list), but if you close the browser and then go back to
> the SSL-enabled site, it asks you to save the cert once again, just
> like it did the first time.
> 
Try rebooting. You should see the certificate in the correct store once you do.
Aryeh
---
Aryeh Katz
VASCO 			
www.vasco.com

---

From: "Drew J. Como" <[email-masked]>
Date: Thu, 25 Apr 2002 09:47:01 -0400

Aryeh,

I actually see the cert in the folder, but for some reason,
it still prompts my users to accept it.

Things that make you go hmm.....

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]]On Behalf Of Aryeh Katz
Sent: Thursday, April 25, 2002 9:25 AM
To: [email-masked]
Subject: Re: Dummy SSL Certs and W32/Internet Explorer

> Is this a browser bug, an unset-setting, or just MS thinking for us
Try rebooting. You should see the certificate in the correct store once you
do.
Aryeh
---
Aryeh Katz
VASCO
www.vasco.com

---

From: "Aryeh Katz" <[email-masked]>
Date: Thu, 25 Apr 2002 09:58:21 -0400

> it still prompts my users to accept it.
Is the CA's certificate in the browser?

---
Aryeh Katz
VASCO 			
www.vasco.com

---

From: "Drew J. Como" <[email-masked]>
Date: Thu, 25 Apr 2002 10:53:17 -0400

Aryeh,

It shows up in the 'Intermediate Certification Authorities'
area, but not in any others.

Is this the problem, and if so, how can I get the cert to
be accepted permanently (atleast until it expires)?

Thanks :-)

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]]On Behalf Of Aryeh Katz
Sent: Thursday, April 25, 2002 9:58 AM
To: [email-masked]
Subject: RE: Dummy SSL Certs and W32/Internet Explorer

---
Aryeh Katz
VASCO 			
www.vasco.com

---

From: "Aryeh Katz" <[email-masked]>
Date: Thu, 25 Apr 2002 11:07:32 -0400

> be accepted permanently (atleast until it expires)?
Install Certificate Wizard->Next->
Place all Certificates into the following store->Browse->
Show Physical Stores->Trusted Root CAs->Registry->
OK
etc.
---
Aryeh Katz
VASCO 			
www.vasco.com

---

From: "Drew J. Como" <[email-masked]>
Date: Thu, 25 Apr 2002 12:27:31 -0400

Aryeh,

I did everything that you had mentioned, but it is
still coming up with the message even after I install
them.  (I haven't rebooted my machine yet, so I don't
know if that has anything to do with it.)

I'll reply back to the list after I reboot and let you
know if that did it.

Thanks :-)

-----Original Message-----
Sent: Thursday, April 25, 2002 11:08 AM

---

From: "Frank Reichenbacher" <[email-masked]>
Date: Thu, 25 Apr 2002 09:37:19 -0700

Drew -

Did you sign the certificate? I forgot to mention that I was unable to get
my IE 6 to accept the CA without prompting until I signed my certificate.

Frank

---

From: "Frank Reichenbacher" <[email-masked]>
Date: Thu, 25 Apr 2002 08:11:16 -0700

You have to install it in the Trusted Root CA Store. Next time it comes up,
choose install and then click stuff until you find an option to install it
to the trusted root store.

You may also be able to install it using Tools|Internet Options|Content, but
I haven't tried it.

I did it the other day for my own test cert and now I don't get prompted to
approve using IE 6.026. Unfortunately, I don't recall the precise steps to
be taken and since I already installed it, I can't duplicate it without
making a new cert.

Frank