Hod do I install enterprise root certificates by default

I am trying to develop en enterprise depployment of Firefox (and Thunderbird for that matter) and I woudl like to be able to provide configuration of the package. I've found the enterprise working group site and through the references there have figured out how to do most of what I'm after. One issue remains -- our organization uses an in house Certificate Authority to generate server and other certificates used throughout our systems. I need to install our CA's certificate into Firefox's trusted root cert store. I can do this within existing user profiles via the nss tools. But, new users (new profiles, actually) won't get this update by default. How can I insure that user's profiles receive our root certificate by default (just like Verisign's and the other certs included by default) when they begin using Firefox?
== User Agent ==
Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C)

See:
http://mxr.mozilla.org/mozilla/source/security/nss/lib/ckfw/builtins/
http://mxr.mozilla.org/mozilla/source/security/nss/lib/ckfw/builtins/README

Similar Messages

HT5012 Can I install two root certificates with the same name in iPad?

Can I install two root certificates with the same name in iPad?

Antaeus00 wrote:
I tried sending a request for help,
But did you succeeed in sending a request for help?
Did you receive a response? How long has it been since you sent a request?
but I need someone with more authority to talk to.
There is no one with more authority than iTunes store support. We herem are only users.

How do I install a Root Certificate on my Iphone for an email account?

I use an email account requiring a root certificate to be installed on my phone. I have this on my PC and need to know how to actually import the certificate to my iPhone. I go through the normal setup with the account which shows the correct port settings, however, without the certificate, every time I try getting emails, it fails to connect with the server. Any ideas??

Thanks for the tip. I emailed the certificate to my other email account on my iPhone, but when I tried to open the attached certificate I got a message - "Invalid Profile - Profile format not recognized."
Any other ideas. I may have to just set up another sure email account with another server.

How to install enterprise trust certificate in iphone

I am trying to use the outlook mail account. But i need to install the enterprise trust certificate before using it. Where i can find the link and how to install it?

Apple have restrictions against adobe on the iphone, ipod touch and ipad. There will not be any flash in the near future.

Fail to install a root Certificate on Q10

Hi all,
I have been trying to install root Certificates on my new Q10 however without luck.
1) What I tried to install were some root certificates (with .crt extension), in particular, one being the 'Deutsche Telecom root CA 2'.
2) I was a bit surprised that these were not including by default, nonetheless started to do it by myself, following the 'official' instructions found on this page:
http://docs.blackberry.com/en/smartphone_users/deliverables/47561/als1342708099072.jsp
3) Tried with WIN, with MAC, via USB, via WIFI, all I could achieve was to put those files on to the so called 'cert' folder on the phone.
4) When trying out the last steps (step 9 and 10, namely to actually import those certificates into the system), the phone did not seem to find the files I just copied!
Can someone give me a clue? Am I using wrong files? Not .crt then what?
Thanks in advance,
Henk

Hello hengzou and welcome to the BlackBerry Support Community Forums.
Sorry to hear you're experiencing an issue importing certificates.
When you are in the Security and Privacy > Certificates > Import are you changing the Class to the appropriate one? As in Personal Trusted CA, Personal Client or Work Client based on the certificate you imported?
Do you see the check boxes to select if it's a VPN, Web, Wi-Fi or Device certificate for store?
If you have tried all these combinations and the issue persists then it is advised you contact your mobile service provider to and ask for a ticket be opened with BlackBerry Technical support so further investigation can be done on this.
Thanks!
-HMthePirate
Come follow your BlackBerry Technical Team on twitter! @BlackBerryHelp
Be sure to click Kudos! for those who have helped you.Click Solution? for posts that have solved your issue(s)!

FYI - installing a root certificate on E71

FYI
We run our own certificate authority for internal websites, and have a page to download the root certificate in PEM format with the appropriate MIME type (application/x-x509-ca-cert). Clicking that in Firefox magically installs the certificate, but the N71 says "malformed certificate". Turns out it wants in in DER format (with the same MIME type). Easy enough to make one with OpenSSL.

Hi
Have you seen and followed this
http://docs.blackberry.com/en/smartphone_users/deliverables/14919/Install_root_cert_for_CA_server_11...
Blackberry Best Advice - Back-up weekly
If I have helped you please check the "Kudos" star on the right >>>>

How to install a root certificate of private CA for SSL initiation in ACE 4710 ?

Hello ACE Gurus,
We have to deploy end-to-end SSL for one of our application, but of course we won't be buying Entrust or other big name certificates for each web server : we want to use self-issued certs signed by our private CA.The topology looks like this :
Internet Client ----HTTPs_Entrust_Cert----> ACE ------HTTPs_Private_Cert------> WebServers
Maybe my search skills are soft, but I haven't found how to import a private CA certificate in the ACE, so that when the ACE initiates an SSL session with the webserver (as a client), it will recognize the Web Server's SSL Cert as valid, because he already has it in it's root store.
The only thing I've found, is how to configure the ACE to ignore the SSL authentification/validation errors, like this :
host1/Admin(config)# parameter-map type ssl SSL_PARAMMAP_SSL
host1/Admin(config-parammap-ssl)# authentication-failure ignore
Thanks for the help!
Alex.

Hi Alex,
From ACE perspective, it doesn't make differences if you are using certificates issued by your local or a "well known" CA. Moreover, if not mistaken, you have to configure authentication group whatever you are doing client or server authentication.
http://www.cisco.com/en/US/partner/docs/app_ntwk_services/data_center_app_services/ace_appliances/vA4_1_0/configuration/ssl/guide/certkeys.html#wp1043643
Thanks,
Olivier

Does Firefox reset all the root certificates and root certificate settings whenever an upgrade is installed?

Does Firefox reset all the root certificates and root certificate settings whenever an upgrade is installed?

Root certificates are stored in the file nssckbi.dll and if you've disabled build-in root certificates then it is possible that they get re-enabled. There is however no reason to disable any of the build-in root certificates.
Tools > Options > Advanced > Encryption: Certificates > View Certificates : Authorities

Windows Root Certificate authority questions.

hello,
I have 2 questions with regards to Offline ROOT CA in a 2 TIER Hierarchy :
(1) Is it necessary to to ” map the Namespace of Active Directory to an Offline CA’s Registry Configuration” ? I didn’t do this step in my lab env and find this in some but
but not all the online posts as well. what happens if we don't run this command on offline CA ?
For instance: certutil.exe –setreg ca\DSConfigDN CN=Configuration,DC=lab,DC=com
(2) What happens if i do not publish the ROOT CA certificate via "certutil -dspublish -f xxx.cer ROOTCA " command but instead just push the root certificate using Default Domain Group Policy Object to "Trusted Root Auth" store
on all the domain machines ? What are the pros/cons of using the certutil method vs the GPO method ?
Thanks
Neeraj

> Is it necessary to to ” map the Namespace of Active Directory to an Offline CA’s Registry Configuration” ?
it is necessary only if you configure LDAP URLs for CRL Dsitribution Points and Authority Information Access extensions on Root CA (not recommended).
> What are the pros/cons of using the certutil method vs the GPO method ?
different scopes. When publishing in Active Directory, it is downloaded to all
*forest* members, while GPO covers only limited scope (domain, site or OU).
Vadims Podāns, aka PowerShell CryptoGuy
My weblog: en-us.sysadmins.lv
PowerShell PKI Module: pspki.codeplex.com
PowerShell Cmdlet Help Editor pscmdlethelpeditor.codeplex.com
Check out new: SSL Certificate Verifier
Check out new:
PowerShell File Checksum Integrity Verifier tool.

Having problem getting installed root certificate to work

We have a recerse proxy set up with an SSL certificate singed by our local CA. We are trying to connect to this reverse proxy from iPad over 3G connection.
Initially, we received the error "Safari cannot open the page because it could not establish a secure connection to the server". Reading up on this, realized that we needed to install the CA root certificate as a trusted root on the device.
Got iPhone Configuration utility, set up a configuration profile for the sole purpose of installing the certificate, added the certificate through Credentials section, and assigned the profile to the device. I can see the certificate updated to the device through General>Profiles and can confirm that it IS the root certificate used to general the SSL certificate on the proxy.
Even after application to the iPad (tried on iPhone also), attempt to access our proxy server from the iOS device fails with the same error.
It is interesting to note, that on a personally owned iPad, instead of the error noted, I received a pop-up indicating the certificate was unknown, and I was presented with options to "Cancel, Details, Continue". Clicking on "Details", I was allowed to view the certificate properties, and ALSO had a button to "Accept". Hitting "Accept" installed the certificate as trusted, and I get through the proxy server just fine. Only problem now is that if I *want* to re-create the prompt, I have no way, as I've found no way to remove certificates from the iPad unless installed via configuration profile.
We've checked and double-checked, and the certificates all "line up" to the correct CA.
Any ideas where I night be going wrong?
Thanks!

New clue....
I only have the problem of not connecting to the proxy server if I'm using a 3G connection. If I turn on wi-fi, connect to an access point, the installed root certificates do their job, and I connect just fine.
Anyone know of potential problems with SSL certificates over 3G?

How to Install Root Certificates

I'm trying to get Safari to recognize websites that use cacert.org SSL encryption. I tried the following precedure, which did not work:
http://www.mecking.net/2011/02/installing-cacert-root-certifcates-on-ios/
I can get the certificates to show up under "Profiles" but this has no effect in Safari and it always tells me "Cannot Verify Server Identity". I tried messing around with the "iPhone Configuration Utility" and got the same results that way.

I have nokia 6300 s40v3 and when I tried to open cert.html it showed format unknown.
What should I do. Can you tell me the format of bookmark so that can rename it to cer.(format)
sir please give some guidense its very urgent
reply at *******
MODERATOR'S NOTE:
Personal details removed by a moderator. We kindly ask you not to share your personal e-mail address or any other personal information publicly on this forum. This is for your personal safety and privacy.
Message edited by Aikin19

MacBookpro Receiving pop up warnings: Error: Unable to establish a secure connection to pop.mail....etc. because the correct root certificate is not installed. Help needed please.

My Entourage is very slow and 2 Error pop ups (above) are showing. Additionaly, a warning about the start up disc being full. I decided to back up to an external HD.When backing up I was surprised to see 9.4GB in the catagory named 'Other'. Ive probably got too much junk stored here (unless it could be imovie files?). If I could see what was in 'Other', and delete what I dont need, this may be the answer to freeing up more space. The next big file I have is under 'Pictures' which is 1.7GB. I have never downloaded any video or Youtube stuff.
This is my first experience on this forum.

Apple in their glorious wisdom did not update the root certificates for users of 10.5, only for 10.6 and later.
You'll need to make some changes, open your Keychain Access in your Applicaitons or Utilitties folder.
Delete the compromised DigiNotar root certificates, also change the KeyChain Access preferences > Certificates to
Best Attempt
Best Attempt
Require Both
Because the Certificate Autorities themselves are being attacked, you need the most recent and varied source of valid certificates so your comptuer does the best it can to verify the site your visiting is legitiment.
Also make sure the time and date on your computer is accurate and updated with Apple's time severs, allow any such time requests out your outgoing firewall (aka LittleSnitch)
You might decide to upgrade to 10.6, it's the best OS version for users of Intel Mac's, strips out the PowerPC code your not using and improved video drivers for better graphics performance. It should run most of your 10.5 software with just minor updates at most.
Please backup your data off the machine (not TimeMachine) before doing anything as you might need to wipe the drive if the upgrade doesn't go correctly.
http://store.apple.com/us/product/MC573Z/A
However OS X Lion 10.7 is a radical change, won't run your older software or drivers and likely be slow on most older hardware. I'd advise against installing it, buy it with a new machine instead.

EDirectory install - failed to retrieve self-signed root certificate:142

Hi,
My istallation has 2 NICs, public & internal.
My tree name is IS.
I have succesfully installed and used RedCarpet. I additionally enabled
the Firewall and DHCP server to allow internet access to my users.
On running Yast install for eDirectory I am given the default IP address
of the server, this is the Public IP address - I decided that eDirectory
was for internal use so changed IP address to internal one.
At 50% of installation an error pops up :-
Error
The installation failed to retrieve the self-signed root certificate:142
I aborted the installation.
I retried the install using the public Ip address, it complains ports are
already in use, I chose ignore and go ahead. Same error occurs :142.
Your assistance and guidance would be appreciated.

> Hi Johan,
>
> Thanks for sticking with me... I appreciate your time and help (believe
> me, It's a great help..)
>
> I have cracked it...
>
> On a reboot, I chose to press F2 to get rid of the Suse Chameleon screen
> and watched the boot process progress. I then noticed that it was unable
> to contact my specified NTP source.
>
> I went into Yast Ntp client and changed my NTP source to other published
> secondary NTP servers and all failed. I then put in the ip address of one
> of the time servers and Bingo! ntp connected...I think I've seen this
> before with Netware...where name resolution of the ntp server name does
> not occur....most ntpserver administrators state they prefer you contact
> the server by name rather than address...hmmm.....
>
> I then retried Yast eDirectory install and it was a breeze, as was the
> iManager install....
>
> GroupWise here I come...
>
> Rgds.
>
> Stan Chelchowski
>
Hi, this is roy.
had the same issue. using a supermicro with a builtin dual nic.
disabled it and installed an old pci nic to test and it finally loaded the
edirectory without an error.
on another note, i am installing the NLSBS 9.0 and had to manually load
the disk drivers since i have an adaptec 2010s raid adapter. i had
installed suse 9.3 on the same machine earlier with absolutely no issues,
but NLSBS is a pain. if you run red carpet and update all, then the driver
issue returns.
how do you get and install the service pack 2?
thanks,
roy

Complete list of pre-installed root certificates in Java keystore?

I need a complete list of from which version and update of JDK, J2SE, Java SE etc different root certificates are pre-installed in the keystore.
Someone that can help?

levhal wrote:
No.
What I need is a list of when the different root certificates was supported by Java. An example could be:
"Thawte Premium Server CA" was preinstalled since J2SE 1.3
"GlobalSign Root CA" was preinstalled since J2SE 1.4.2 update 16Write to Sun/Oracle since I doubt if anyone visiting this site has such a list or has access to the information required to create such a list.

Incorrect root certificate is installed

Since about November, whenever I log onto my Entourage, [version 2008 12.3.2], program to receive e-mail that is associated with my Ip, I get an error message that tells me that Entourage is "unable to estalbish a secure connection to pop-sbc.mail.am0.yahoons.net because the correct root certificate is not installed" - then underneath the error message, is "If you continue, the information you view & send will be encrypted, but will not be secure". Then there is a link for you to click on that states - "More information on installing root certificates...", that directs you to Entourage Help. They offer instructions for installing root certificates on Mac OS X (Tiger), & Mac OS X (Leopard).
FYI - My Ip is ATT-Uverse. My Entourage e-mail account is set up as a POP3 account, & the server is : att.yahoo.net & it is not my default e-mail account. My default e-mail account uses the me.com server.
Resolution offered by "Help" in my Entourage program:
The instructions for Leopard state - "1. Double-click the root certificate to open the Keychain Access application. The Add Certificates dialog box appears. - 2. On the Keychain menus, click login, and then click OK. If the Do you want your computer to trust certificates...dialog box appears, click Always Trust. Note: If you're asked top provide a name & password, type the name and password for an administrator. & 3. Quit and then restart Entourage."
My question in regards to the steps offered is - Where does one find the "root certificate"? When I open the Keychain Access application, I see more than one type of root certificate. Therefore I don't know which one they are referring to. In the Entourage Account settings, there is a category called , "Digital ID", or something like that. I clicked on that category & the current settings show that "none selected" for digital ID's, however when one changes the setting to "select", the certificate that is selected is a certficate for mac.com.
How does one change this setting?
FYI: Everytime I talk with someone from Apple Tech support or from ATT-Uverse Tech Support & tell them my problem, I am referred to a "Third Party Support" Tech. In both cases, I am told that I will have to pay for the Tech Support. I have also been told to contact Microsoft. I was temporaily able to fix the problem in December when the ATT-Uverse Tech Support person told me that I should change the name of the server in the settings of my POP3 account, but within a couple weeks I started receiving the same error message.
Has anyone else come across this problem?

Martha,
Thanks for taking the time to get back to me. I did some more investigation yesterday after I sent my question to you. At this discussion
https://discussions.apple.com/thread/3561161?start=0&tstart=0
there's a reply from iChop, about four replies down, that spells out how to change some settings. That proved effective for me, and apparently for others, too.
Good luck!

Hod do I install enterprise root certificates by default

Similar Messages

Maybe you are looking for