IE7 not saving a self signed SSL cert

Burble · 04-07-2008, 12:26

A few weeks ago I migrated my email platform over to Exchange running on my ESX server. I've setup OWA (and POP3 + IMAP4) using a self signed SSL certificate.

Thunderbird has accepted and saved the certificate even though it isn't valid (remember, it's self signed) but IE7 refuses to do the same. Every time I connect to OWA it warns me that the certificate is not valid so I have to click the link to continue to the site.

Next to the addressbar is another bar telling me about the certificate error. If I click that and choose 'view certificates' then I have the option to install the certificate. I click that and go through the import wizard then get a message saying that the import was succesful but each time I connect to OWA it tells me that the certificate isn't valid.

Any ideas? it doesn't bother me because I rarely use OWA but my Mother and Brother often do.

Feek · 04-07-2008, 12:56

Good luck. I've been trying to persuade IE7 to save a cert for my VPN with no luck. In the end I've just trained users to accept it each time.

Daz · 04-07-2008, 13:12

Have you imported the whole chain? You may have more luck importing the root CA certificate as well. I've had to do that for other MS apps with my own self signed certs (same thing actually, OWA and activesync on my Touch).

Burble · 04-07-2008, 13:31

Good idea Daz, I'll give that a go.

Daz · 04-07-2008, 13:48

It's probably the better way round it. If your system trusts your root CA then the browser (along with anything else, including the Windows VPN clients) will carry on regardless, assuming the name and date are ok anyway.

It does sound like a typical MS thing when you think about it. We'll allow exceptions, even prompt you to add an exception, but it only works if we trust your root (so only covers incorrect names or expired dates), and we wont tell you about it at the time. Just bury an article in MSDN somewhere.

Burble · 04-07-2008, 14:04

Yeah, if I had thought about it logically I should have already come to the same conclusion.

04-07-2008, 12:26	#1
Burble Rocket Fuel Join Date: Jul 2006 Posts: 7,826	IE7 not saving a self signed SSL cert A few weeks ago I migrated my email platform over to Exchange running on my ESX server. I've setup OWA (and POP3 + IMAP4) using a self signed SSL certificate. Thunderbird has accepted and saved the certificate even though it isn't valid (remember, it's self signed) but IE7 refuses to do the same. Every time I connect to OWA it warns me that the certificate is not valid so I have to click the link to continue to the site. Next to the addressbar is another bar telling me about the certificate error. If I click that and choose 'view certificates' then I have the option to install the certificate. I click that and go through the import wizard then get a message saying that the import was succesful but each time I connect to OWA it tells me that the certificate isn't valid. Any ideas? it doesn't bother me because I rarely use OWA but my Mother and Brother often do.

04-07-2008, 12:56	#2
Feek ex SAS Join Date: Jun 2006 Location: JO01ou Posts: 10,062	Good luck. I've been trying to persuade IE7 to save a cert for my VPN with no luck. In the end I've just trained users to accept it each time. __________________

04-07-2008, 13:12	#3
Daz The Stig Join Date: Jun 2006 Location: Swad! Posts: 10,713	Have you imported the whole chain? You may have more luck importing the root CA certificate as well. I've had to do that for other MS apps with my own self signed certs (same thing actually, OWA and activesync on my Touch). __________________ apt-get moo

04-07-2008, 13:48	#5
Daz The Stig Join Date: Jun 2006 Location: Swad! Posts: 10,713	It's probably the better way round it. If your system trusts your root CA then the browser (along with anything else, including the Windows VPN clients) will carry on regardless, assuming the name and date are ok anyway. It does sound like a typical MS thing when you think about it. We'll allow exceptions, even prompt you to add an exception, but it only works if we trust your root (so only covers incorrect names or expired dates), and we wont tell you about it at the time. Just bury an article in MSDN somewhere. __________________ apt-get moo

04-07-2008, 13:31	#4
Burble Rocket Fuel Join Date: Jul 2006 Posts: 7,826	Good idea Daz, I'll give that a go.

04-07-2008, 14:04	#6
Burble Rocket Fuel Join Date: Jul 2006 Posts: 7,826	Yeah, if I had thought about it logically I should have already come to the same conclusion.