This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

[7.102] Digitally signing not working correctly due the "unknown CA"

Hi all,

I just got my PGP-keys and want to "Digitally Sign" my (personal account) e-mail. The problem is when the e-mail is signed and send to a MS Outlook client it gives an error-message that the CA Authority is "unkown". This make sence because when you enable "Encryption" in the "E-mail section"; a certificate is created. This isn't know by any "official" CA Authority.
I do have a wildcard for my domain but I can't import the certificate into ASG so it has an official SSL-certificate. This is the way I did the configuration:

1) E-mail Security->Encryption-> Enable (Global tab), and the Email encryption certificate authority (CA) is created
2)Options tab-> at Default Policy I only check "Sign outgoing email" (others are unchecked and saved it)
3) OpenPGP public keys tab-> I upload my pubring.pkr.
    pgp[global directory verification key PGP Global Directory Verification Key]
    me@example.com [Me Too]
Are now imported
4) Internal Users tab->I add a new user, I fill in
    my e-mail address
    Full name
    set Signing on
    Decryption: Use default policy
    S/MIME: Generate cert
    OpenPGP: Upload ASC file, where I upload my asc-file without the "private-key(s)"
5) Then it's generating/importing the settings....
===> When I do send an e-mail to an Outlook client the signing gives an error because the CA-certificate is not trusted!!!!

Did I do something wrong? Can someone help me with this?

This thread was automatically locked due to age.

Parents

0 BrucekConvergent over 17 years ago

I believe that the Astaro email encryption feature encrypts outgoing email using S/MIME only (not PGP); thus, if you are using the Astaro-generated S/MIME cert for your email config for the email sender in question, the Certificate store on the client's PC will not (by default) have a CA that will allow it to trust the email.

To fix this problem, manually generate a S/MIME cert for the user (using a CA that is "globally" trusted), then import it into the Astaro for that user.

CTO, Convergent Information Security Solutions, LLC

https://www.convergesecurity.com

Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries. Use the advice given at your own risk.
Cancel
Vote Up 0 Vote Down

Cancel
0 PabloDiablo over 17 years ago in reply to BrucekConvergent

Thanks for the fast reply BrucekConvergent!

Call me stupid [;)]. But is it possible to create your own S/MIME certificate from a "real" SSL-certificate? If so can you give me some "hints" so I can create one?

Thanks in advance.
Cancel
Vote Up 0 Vote Down

Cancel
0 BrucekConvergent over 17 years ago in reply to PabloDiablo

I don't understand the question... generally a S/MIME cert, in order to be "globally" trusted, needs to be a "child" of a "big name" CA, or a subordinate CA. This means buying one (or subscribing to a service that allows you to create your own) from one of the big names, like Verisign, etc.

There's not really a way around this. However, you can export the built-in CA cert, import it into the client's Windows certificate store as a Trusted 3rd Party CA, and the alerts will go away in outlook.. but this really isn't practical. Just buy them from one of the commercial CA services.

CTO, Convergent Information Security Solutions, LLC

https://www.convergesecurity.com

Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries. Use the advice given at your own risk.
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 BrucekConvergent over 17 years ago in reply to PabloDiablo

I don't understand the question... generally a S/MIME cert, in order to be "globally" trusted, needs to be a "child" of a "big name" CA, or a subordinate CA. This means buying one (or subscribing to a service that allows you to create your own) from one of the big names, like Verisign, etc.

There's not really a way around this. However, you can export the built-in CA cert, import it into the client's Windows certificate store as a Trusted 3rd Party CA, and the alerts will go away in outlook.. but this really isn't practical. Just buy them from one of the commercial CA services.

CTO, Convergent Information Security Solutions, LLC

https://www.convergesecurity.com

Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries. Use the advice given at your own risk.
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data