Security Certificates: Difference between revisions

From help.computerisms.ca
Jump to navigation Jump to search
 
(97 intermediate revisions by 6 users not shown)
Line 1: Line 1:
==FAQ==
*Where can I download a copy of the Certificate Authority?
**right-click <b>[[Media:Computerisms.Root.Certificate.pem|This Link]]</b> and choose "Save As" or "Save Target As", or "Save Link As"
**Or use <b>[[Media:Computerisms.Root.Certificate.p12|This Link]]</b> if your device or computer needs a P12 Certificate
**Or use <b>[[Media:Computerisms.Root.Certificate.crt|This Link]]</b> if your device or computer needs a DER encoded Certificate (Android)
*I told firefox to make an exception for the webmail certificate, but every once in a while it pops up again...
**Ya, that is expected behaviour.  The best solution is to install the Certificate Authority as described in the videos below.
==VIDEO: Instructions for installing the Certificate Authority (AKA, getting rid of those warnings)==
{| style="width: 100%; border-spacing:15px;border-collapse:separate;border: 1px solid rgb(191, 238, 255); background-color: rgb(255, 235, 205);text-align:center;font-size:1.5em;"
|- valign="center"
||[[file:Microsoft_windows.png|link=https://help.computerisms.ca/images/e/e1/Windows_CA_Install_Revised.mp4|Windows|75px]]
||[[file:Mac_icon.png|link=http://help.computerisms.ca/images/6/6f/InstallCA-OSX.mp4|Mac OS X|75px]]
||[[file:thunderbird_logo.png|link=https://help.computerisms.ca/images/d/d3/Thunderbird_CA_Install.mp4|Thunderbird|75px]]
|-
|| [[Media:Windows_CA_Install_Revised.mp4|Windows]]
|| [[Media:InstallCA-OSX.mp4|Mac OS X]]
|| [[Media:Thunderbird_CA_Install.mp4|Thunderbird]]
|}
==Importing Certificate Authority==
*[[How to import Certificate Authority in Windows 7]]
*[[How to import Certificate Authority in Windows 10]]
*[[How to import Certificate Authority on iPhone]]
*[[How to import Certificate Authority on MAC]]
*[[How to import Certificate Authority on Thunderbird]]
*[[How to import Certificate Authority on Outlook]]
==What are Security Certificates and what are they used for?==
==What are Security Certificates and what are they used for?==
*All sites you visit that have https:// in the address bar are encrypted using a certificate
*All sites you visit that have https:// in the address bar are encrypted using a certificate
Line 8: Line 38:
**When two certificates trust each other, they can be used to encrypt a connection
**When two certificates trust each other, they can be used to encrypt a connection
***This is especially important when transmitting a username and password across the internet
***This is especially important when transmitting a username and password across the internet
**So by installing Computerisms Certificate Authority on your computer, you are instructing your computer to trust Computerisms Services, and your computer will not longer display a warning that you are connecting to an untrusted service.
*Every password protected service provided by Computerisms will use Security Certificates to encrypt network connections
*Every password protected service provided by Computerisms will use Security Certificates to encrypt network connections


Line 23: Line 54:
**By temporarily overriding the warning, you instruct your computer to trust the certificate on the server
**By temporarily overriding the warning, you instruct your computer to trust the certificate on the server
**Once the trust is established, then the certificates can be used to encrypt the communication so your password is not transmitted in clear text
**Once the trust is established, then the certificates can be used to encrypt the communication so your password is not transmitted in clear text
**Installing the Computerisms CA on your computer will make it so your computer trusts the server's certificate without throwing a warning
*Another reason a security certificate warning might pop up is a mismatched address
*Another reason a security certificate warning might pop up is a mismatched address
**Computerisms Webmail is one site that answers to many names, such as [[Domain Substitution|https://webmail.domain.tld]]
**Computerisms Webmail is one site that answers to many names, such as [[Domain Substitution|https://webmail.domain.tld]]
**If you arrive at the site by a name that is different than the one on the certificate, your computer will warn you that the address in your address bar is not the same as the address on the certificate.
**If you arrive at the site by a name that is different than the one on the certificate, your computer will warn you that the address in your address bar is not the same as the address on the certificate.
**Computerisms endeavours to make sure all of its customer's names are on the certificate, so this problem should not be seen when connecting to Computerisms Services.
***This might happen if you are using an IP address to connect, or are otherwise subverting normal operations
*Remember, regardless of the warning, when you instruct your computer to trust the certificate, encryption will still happen.  So long as you know the certificate, even if your computer doesn't, you will be sending your passwords over the internet encrypted, so people can't see it.  You should not send a password on an unencrypted connection.
**Computerisms endeavours to make sure all of its customer's names are on the certificate, so this problem should not be seen when connecting to Computerisms Services
***If you do see this problem, it is the result of a typo or other accidental misconfiguration. Please [mailto:bob@computerisms.ca notify us] if you see this
*Remember, regardless of the warning, when you instruct your computer to trust the certificate, encryption will still happen.  So long as you know the certificate you will know who you are connecting too, even if your computer doesn't, so you will be sending your passwords over the internet encrypted in such a way that other people can't see it.  You should not send a password on an unencrypted connection.


==Okay, Now I know why, but what do I do about it?==
==Okay, Now I know why, but what do I do about it?==
*If one extra click every time you use a Computerisms Service does not seem unreasonable, then one viable option is to do nothing
*If one extra click every time you use a Computerisms Service does not seem unreasonable, then one viable option is to do nothing
*In some cases, the problem can be solved on the server.   
*In some cases, the problem can be solved on the server.   
**If for example you wish to run an online store, you will need to purchase your own certificate
**Purchased certificates solve the problem, but are too cost prohibitive to provide globally to all customers
**In the case of providing encrypted services in a hosting environment, purchasing certificates is very cost prohibitive
***Since we can't provide purchased certificates, it is better to have a self-signed certificate and provide education regarding the warning than it is to have no certificate at all.
***it is better to have a certificate and provide education regarding the warning than it is to have no certificate at all
****Without the certificate, we cannot encrypt the transmission of your password
*While Security Certificates are an open standard, implementation varies quite a bit depending on the browser and platform it runs on
**you can purchase a certificate and [mailto:bob@computerisms.ca Computerisms] will install it for you
**If you use Internet Explorer, you can [[#Internet Explorer - Importing Certificate Authority|import the CA]] to establish trust
**Computerisms can assist with the acquisition of a certificate, please [mailto:bob@computerisms.ca contact us] for information
***Under some circumstances you may want to temporarily [[#Internet Explorer - disable Name Matching|disable Name Matching]]
*You can import the CA into your system so as to put a certificate on your machine that will recognize and trust the certificate on the server
***While [[#Internet Explorer - disable Name Matching|disabling Name Matching]] might seem a convenient thing, keep in mind that this disables the security warning, meaning you won't get a warning when you do connect to a "real" disreputable site
***Disabling Name Matching should be unnecessary, and will only be required as the result of a typo or similar error.  Please contact [mailto:bob@computerisms.ca Computerisms] if you find this is necessary
**Firefox is probably the easiest browser to deal with, Just add a [[#Firefox|Security Certificate Exception]] for any site or Computerisms Service that gives you the error
**For Google Chrome, [[#Internet Explorer - Importing Certificate Authority|importing the CA through internet explorer]] will fix the problem
 
==Internet Explorer - Importing Certificate Authority==
*<b>What this will do:</b>
**This will build a trust relationship between the certificates on the server and the certificates on your computer
**This will make it so that any Computerisms Service whose address is the same as that on the certificate will not prompt a warning
***This will apply to most, but not all services
*<b>What this will NOT do:</b>
**This will not get rid of the warning when you connect to a Computerisms Service using a different name than is on the certificate
***This will mostly be with webmail, where one site shares several names
**To get rid of the warning in the case of an address mismatch, you will need to [[#Internet Explorer - disable Name Matching|disabling Name Matching]]
***While [[#Internet Explorer - disable Name Matching|disabling Name Matching]] might seem a convenient thing, keep in mind that this disables the security warning, meaning you won't get a warning when you do connect to a disreputable site
{| style="width:100%" border="1" cellspacing="0"
|-
|style="width: 50%"|
*The easiest way to install a certificate is using Internet Explorer
*Open  your start menu and choose "All Programs"
*In the list, right click Internet Explorer
*In the menu, choose "Run as Administrator"
*If you are presented with a window confirming the program should be allowed to make changes to your computer, select Yes
|[[File:Help.cert.run.ie.as.admin.png|center|500px]]
|-
|[[File:help.cert.warning.png|center|500px]]
|
*Navigate to [[Domain Substitution|https://rc.domain.tld]] or any other encrypted Computerisms service
*Select "Continue to this website (not recommended)
**For the record, it is recommended...
|-
|
*In the next window, you will notice the address bar goes red.
*Click in the address bar where the X is displayed as a certificate warning
|[[File:help.cert.address.bar.png|center|500px]]
|-
|[[File:help.cert.view.cert.png|center|500px]]
|
*In the small window that opens up, click the link at the bottom called "View certificates"
|-
|
*In the next window, find the tab called "Certification Path" and click it
*Click on the line that says Computerisms Certificate Authority
*Then click the "View Certificate" Buttonhelp.
|[[File:help.cert.choose.CA.png|center|500px]]
|-
|[[File:help.cert.install.cert.png|center|500px]]
|
*In the next window, click the button called "Install Certificate"
**Note: if you did not run Internet Explorer as Administrator, this button will not show up
|-
|
*The next window will be the start of the Certificate Import Wizard
*Click Next
|[[File:help.cert.import.1.png|center|500px]]
|-
|[[File:help.cert.import.2.png|center|500px]]
|
*Move the Radio button to be beside "Place all Certificates in the following store"
*Click the browse button to open the navigation window
*In the navigation window, select "Trusted Root Certification Authorities"
*Click OK, then click Next
|-
|
*Click the Finish button
|[[File:help.cert.import.3.png|center|500px]]
|-
|[[File:help.cert.import.warning.png|center|500px]]
|
*Another warning window will pop up, click Yes in the bottom right corner
|-
|
*A window will pop up confirming the import was successful, click OK on that window
*Click OK on the Computerisms Certificate Authority Certificate Window
*Click OK on the first Certificate Window
|[[File:help.cert.import.confirm.png|center|500px]]
|}
 
==Internet Explorer - disable Name Matching==
*<b>NOTE: Do not do this unless you fully understand the implications of doing so.  While this may seem convenient, it also comes with its own dangers.  You have been warned!</b>
*<b>2nd NOTE: This action should not be necessary for connecting to Computerisms Services.  if you need to do this, it means a configuration error has taken place, please contact [mailto:bob@computerisms.ca Computerisms] if you find it necessary to do this</b>
*<b>What this will do:</b>
**This will remove the Security Certificate warning when you arrive at a Computerisms service whose real name does not match the name you used to arrive
***For example, the [[Round Cube]] Webmail client's real address is https://rc.computerisms.ca, but if you arrive there by typing [[Domain Substitution|https://rc.domain.tld]], Internet Explorer will generate a Name Mismatch error unless this setting is disabled
**This will also disable the warning for real non-legitimate sites
*<b>What this will NOT do:</b>
**This will not create a trust relationship between your computer and the server
**This will not warn you when you encounter a site with a "real" fraudulent certificate
{| style="width:100%" border="1" cellspacing="0"
|-
|style="width: 50%"|
*Open Internet Explorer
*Click the Tools Icon
*Select Internet Options
|[[File:Help.cert.internet.options.png|center|500px]]
|-
|[[File:Help.cert.disable.name.match.png|center|500px]]
|
*Select the Advanced tab
*Scroll to the very bottom of the list
*Deselect "Warn about certificate address mismatch*"
*Click OK
*Restart Internet Explorer
|-
|}
*<b>NOTE: Do not do this unless you fully understand the implications of doing so.  While this may seem convenient, it also comes with its own dangers.  You have been warned!</b>
 
==Firefox==
*<b>What this will do:</b>
**This will create an exception list specific to Firefox so that it knows not to show you the certificate warning for a specific name of a specific site
*<b>What this will NOT do:</b>
**This will not create a trust relationship between the server and your computer, it only ignores this warning
**This will not make the warning go away if you arrive at a previously excepted site by a different name
***For example, if you confirm an exception for https://mail.computerisms.ca, you will still get the warning if you go to https://webmail.computerisms.ca, even though they are the same site
{| style="width:100%" border="1" cellspacing="0"
|-
|style="width: 50%"|
*Open Firefox and navigate to a site that will generate the Security Certificate warning, such as https://rc.computerisms.ca
*Click on the link called "I understand the risks"
*Click on the button called Add Exception
|[[File:help.cert.ff.add.exception.png|center|500px]]
|-
|[[File:help.cert.ff.confirm.exception.png|center|500px]]
|
*Click the "Confirm Security Exception" button
**If the button is greyed out, give it a few seconds and it should come back
|-
|}

Latest revision as of 13:47, 7 October 2020

FAQ

  • Where can I download a copy of the Certificate Authority?
    • right-click This Link and choose "Save As" or "Save Target As", or "Save Link As"
    • Or use This Link if your device or computer needs a P12 Certificate
    • Or use This Link if your device or computer needs a DER encoded Certificate (Android)
  • I told firefox to make an exception for the webmail certificate, but every once in a while it pops up again...
    • Ya, that is expected behaviour. The best solution is to install the Certificate Authority as described in the videos below.

VIDEO: Instructions for installing the Certificate Authority (AKA, getting rid of those warnings)

Windows Mac OS X Thunderbird
Windows Mac OS X Thunderbird


Importing Certificate Authority

What are Security Certificates and what are they used for?

  • All sites you visit that have https:// in the address bar are encrypted using a certificate
  • Security Certificates are a method of establishing trust and encrypting communication between different entities on a network
    • An entity can be a person or a computer
    • Certificates are issued to each entity, much like an identification card might be issued to each member of an organization
    • Each Certificate must be signed by a Certificate Authority, often referred to as the CA
      • Every certificate signed by the CA will have a trust relationship with every other certificate that is also signed by the same CA
    • When two certificates trust each other, they can be used to encrypt a connection
      • This is especially important when transmitting a username and password across the internet
    • So by installing Computerisms Certificate Authority on your computer, you are instructing your computer to trust Computerisms Services, and your computer will not longer display a warning that you are connecting to an untrusted service.
  • Every password protected service provided by Computerisms will use Security Certificates to encrypt network connections

So why do I get a Security Certificate Warning?

  • Certificate warnings can be caused by several factors, but the most important thing to know is that just because you see a warning does not mean the connection is not encrypted
  • One possible reason for the Certificate Warning is that your computer does not know the origin of the certificate on the server
    • When you go to an https enable site that does not show the warning, it is because a purchased certificate on the server and a certificate on your computer have been signed by the same CA
    • When one generates his own Certificates instead of purchasing them, as Computerisms does, they are considered Self-Signed.
    • Since Computerisms uses self-signed certificates and doesn't pay the fees to have its certificates signed by the same CA used by your computer, your computer will not trust the server's certificate
      • A person with the right knowledge can set up a system that is just as secure at a fraction of a fraction (yes, a fraction of a fraction) of the cost of purchasing certificates
      • Using paid Certificates on a Hosting Server that is hosting many domains is prohibitively expensive
    • Since your computer cannot verify the origin of the certificate on the server, it cannot establish a trust relationship with the server
      • The warning will inform you that the certificate on the server cannot be trusted because its origins cannot be confirmed
      • Since you know the origins of the certificate (It comes from Computerisms), you can override your computer's paranoia
    • By temporarily overriding the warning, you instruct your computer to trust the certificate on the server
    • Once the trust is established, then the certificates can be used to encrypt the communication so your password is not transmitted in clear text
    • Installing the Computerisms CA on your computer will make it so your computer trusts the server's certificate without throwing a warning
  • Another reason a security certificate warning might pop up is a mismatched address
    • Computerisms Webmail is one site that answers to many names, such as https://webmail.domain.tld
    • If you arrive at the site by a name that is different than the one on the certificate, your computer will warn you that the address in your address bar is not the same as the address on the certificate.
      • This might happen if you are using an IP address to connect, or are otherwise subverting normal operations
    • Computerisms endeavours to make sure all of its customer's names are on the certificate, so this problem should not be seen when connecting to Computerisms Services
      • If you do see this problem, it is the result of a typo or other accidental misconfiguration. Please notify us if you see this
  • Remember, regardless of the warning, when you instruct your computer to trust the certificate, encryption will still happen. So long as you know the certificate you will know who you are connecting too, even if your computer doesn't, so you will be sending your passwords over the internet encrypted in such a way that other people can't see it. You should not send a password on an unencrypted connection.

Okay, Now I know why, but what do I do about it?

  • If one extra click every time you use a Computerisms Service does not seem unreasonable, then one viable option is to do nothing
  • In some cases, the problem can be solved on the server.
    • Purchased certificates solve the problem, but are too cost prohibitive to provide globally to all customers
      • Since we can't provide purchased certificates, it is better to have a self-signed certificate and provide education regarding the warning than it is to have no certificate at all.
        • Without the certificate, we cannot encrypt the transmission of your password
    • you can purchase a certificate and Computerisms will install it for you
    • Computerisms can assist with the acquisition of a certificate, please contact us for information
  • You can import the CA into your system so as to put a certificate on your machine that will recognize and trust the certificate on the server
Retrieved from "http://help.computerisms.ca/index.php?title=Security_Certificates&oldid=3021"