IMAP with self-signed certs?

I don't yet have my iPhone (ordered online), but I'm wondering if the email client can use IMAP servers via SSL that use a self-signed certificate. Can anyone test that or confirm/deny it based on some kind of published Apple documents or something? I haven't found a solid answer in my searchings.

I can tell you it was a PITA to get working - I first tested sans ssl, then had to reset the iPhone before it would completely forget the old mail config (due to my playing w/ :port# tacked onto the hostname). Plus the iPhone docs need a small amount of work, I think.
Is courier listening on port 993 for imaps? That's what the iPhone will use when you turn on 'secure incoming'.
Setting the :port# in the server field only works for the outgoing server. Don't explicitely set it for incoming, else you'll go through the same aggravation I did (and eventually reset and enter it from scratch).

Similar Messages

  • IMAP SSL doesnt work in iOS 8.0.2 with self-signed cert.

    Got several mailaccounts setup on my iPhone, four of them is LDAP SSL with the server running self-signed cert (expires 2039).
    When I upgraded to iOS 8.0.2 (iPhone 5S) I got problem with Network settings so I did a "Reset Network Settings" (General > Reset).
    After that all my LDAP SSL based emailaccount cannot be "Verified". I have tried reinstall them all but cannot even set them up anymore!!
    I then setup with EXACTLY the same settings in Mail on my MacAir and it did work like a charm instantly. (Im working as a IT Tech so this is peanuts).
    I have even tried to import the certificate (.pem) from Keyaccess Chain into my iPhone. So that one is installed.
    In older iOS you could tell "Continue" when it said "Certificate is not trusted". Just clicked Continue and it worked anyway!
    What to do?
    In iOS 8.0.2 this is not showing to accept the certificate! Now it only shows:

    Nothing anyone here can do, but you should report it to Apple: http://www.apple.com/feedback/

  • ASA5505 IPSEC only with Self-Signed certs

    Hello all,
    I have limited Cisco training and have been tasked with a pilot project. We have scavenged the ASA from another department, but I have no access to support. It's running ASA v9.1 and ASDM 7.1 . If all goes well I'll be sent on training and we will be purchasing a nice 5520.
    So I've scoured the internet for an easy guide to do as my tittle says, but am having major difficulties. I can find lots of support for SSL VPN with Self-signed or IPSEC VPN with externally signed certs but I can't get ASA self-signed IPSEC IKEv2 only with certificate authentication. Also, to make it even worse, I need to provide the user with the software, profile and certificate by hand. No web-access portal or download.
    If you know where I can get good setup guide for this type of use please by all means save me here . If this isn't even possible I'm cool with that, just let me know.
    Thanks fo any help you can provide
    Jay

    If the ASA is using a certificate issued by a CA that is in the client's trusted root CA store, then the ASA identity certificate does not need to be imported by the client.
    That's why it's generally recommend to go the route of using a well-know public CA as they are alreay included in most modern browsers and thus the client doesn't need to know how to import certificates etc.
    If you are using a local CA that is not in the client's trusted root CA store to issue your ASA identity certificate or self-signing certificates on the ASA then you need to take additional steps at the client.
    In the first case, you would import the root CA certificate in the trusted root CA store of the client. After that, any certificates it has issued (i.e the ASA's identity certificate) would automatically be trusted by the client.
    In the second case, the ASA's identity certificate itself would have be installed on the client since it (the ASA) is essentially acting as it's own root CA. I usually install them in my client's Trusted Root CA store but I guess that's technically not required, as long as the client knows to trust that certificate.

  • Site with self-signed cert no longer loads in FF 4

    When attempting to load a page with aself-signed cert, one that previously loaded in 3.x, I now get the following error:
    Renegotiation is not allowed on this SSL socket.
    (Error code: ssl_error_renegotiation_not_allowed)
    I was accessing via https.

    See:
    * http://wiki.mozilla.org/Security:Renegotiation

  • Issue with self-signed Extensions

    I am packaging my extension with self signed cert that is created with the ZXPSignCmd executable.
    It functions correctly and the -verify command confirms the ZXP is good to go.
    When a user install the extension, however, it only functions once the first time they open Illustrator after installing it. Every time after that, when Illustrator is opened, the panel is completely blank.
    This issue can be resolved by enabling PlayerDebugMode on the end-user's .plist file (as outlined for developers in the blog) but obviously this is something I do not want the end user doing. Does anyone have insight as to why the extension panel only loads once, and then breaks? Enabling PlayerDebugMode addresses the issue, but I can't figure out why. I assume is has something to do with the the way it is signed, but I would like confirmation/clarification if anyone knows what is going on.

    Ok, I've validated my html and I'm getting a few errors related to Angular. They're all one of two types of errors
    Error 1:
    <div ng-controller="ExampleController">
    Gets the following error:
    Attribute ng-controller not allowed on element div at this point.
    Error 2:
    <my-directive></my-directive>
    Gets the following error:
    Element my-directive not allowed as child of element div in this context. (Suppressing further errors from this subtree.)
    Error 1 is for any Angular related thing...ng-click, ng-controller, ng-show, etc.
    Error 2 appears where all my custom directives are.
    I did a comparison between the not-working extension and a working one that also uses Angular (without any custom elements). When I validated the working extension, it returned a bunch of Error 1's but no Error 2's (this is expected, seeing as there are no custom elements).
    To your question about dynamic HTML - there is none. All of the files are static after they're installed. I double checked this by running a diff-merge between the extension before and after it has been run once. They are exactly the same, so no files are changing.
    There are known issues with custom directives in older browsers like IE8 - http://www.befundoo.com/blog/angularjs-directives-in-ie8/
    Out of curiosity, I tried adding elements in the head, as described in the above blog, inside my extension. This did not have any effect, and the extension still fails.
    I'm considering rewriting my directives as attributes instead of elements, and seeing if that does it. That would take some time though, so if the above info helps narrow down the problem or raises other questions of yours, I'm all ears! Thanks again for all the replies!

  • Local, self-signed cert for SSL IMAP on Tiger?

    I have a co-located Xserve running Server 10.4.11 (Up time: 380 days!) with IMAP, where I have admin access to install SSL certificates, but I don't quite have the justification to purchase one from a CA.
    I also have several Mac computers where I read my email via IMAP with SSL encryption, and I was wondering if there is any way that I could install a self-signed certificate on my local computers that matches my Xserve and would be sufficient to make Mail.app stop complaining about my server.
    I've been searching the web for tutorials on SSL, thinking that there must be some kind of provision within SSL where I could just set up all machines to be aware of a self-signed certificate in a protected file somewhere on each computer, and I assume that it should be possible to make SSL happy to talk between my own computers. But it seems that most SSL tutorials focus on https, not IMAP or other non-web networking connections. Also, I have a sinking feeling that if I did find information, then it might not be appropriate for the exact directory structure of Tiger. If anyone can help or provide pointers, it would be most appreciated.
    P.S. I could potentially used a "free" signed certificate, but it is attached to a virtual domain that I am hosting on my Xserve, and I assume that it wouldn't match the domain of my email unless I juggle things around. Also, that free cert would eventually expire, and then I'll be back to the current situation of needing to use a self-signed cert.

    Never mind. I figured it out.
    First of all, my Xserve certificate did not have the full FQDN, just a convenient subset. I created another self-signed cert with the true FQDN. I saw some hints around the web saying that Mail.app will always complain if the DN does not match.
    Second, it turns out that Keychain Access is where the local certs live, and in Tiger I needed to drag the cert to my Desktop, open it, and store it in the x509 section.
    All is good. Now to see how my iPhone likes the new certs...

  • Anyone having issues with Self-Signed SSL-certs on mail servers?

    Can't get it to allow connecting via SSL to outgoing mail servers with self-signed certificates. Problem did not exist in earlier versions of OSX as far as I know.

    YES. I have a cert from lunarpages, where my accounts are hosted. I'm seeing two issues, and they are different for the different servers at lunarpages:
    1. Multiple logins from different machines --> problem
    2. Multiple accounts accessing same server --> problem
    So, with 1 account on one of lunarpages machines, I can have several machines running Mail with ssl on at the same time and get no problem (that is, once I've saved the certificate and marked it trusted). But as soon as another account (my wife's email on the same domain, for example) tries to access the same server, it gives me an ssl error, a choice to save that cert. and if I do then my account will generate the ssl error. Seems like only one account can have the certificate.
    On another account on a different lunarpages machine, I can't have several machines running Mail at the same time, only the first will get through and the rest will give an SSL error.
    Lunarpages says they can't find a problem, though my last email with them told me to use TLS rather than SSL. Of course, there's no way to specify that in Mail anyway, but I'd thought Mail automatically used TLS anyway, and I'm running the right ports (587 for smtp, 993 for incoming).
    Feels like it's an issue with Mail or the OS's handling of certificates. Any clues on a fix will be most appreciated as this is getting annoying. I've had to turn off SSL on my wife's and daughter's accounts just so that I can use it. And I have to quit Mail so that on the other account I can get my mail on my iPhone. Having to quit Mail on my main work machine is frustrating -- if I forget to do it I can't get mail.

  • Activate SSL with OpenSSL Self-Signed Cert

    Dear Expert,
    Anyone can give me guidance on how to activate and create ssl cert in Java IM using openssl self-signed cert.
    thanks

    Here how I make it work. Some of the tips is from jay in this forum
    Instant Messaging with SSL
    Let say I have Messaging, Directory, IM server in 1 box.
    Let's create a cert
    # cd /etc/opt/SUNWiim/default/config/
    a) Sun [TM] ONE Messaging Server 6.1 and Sun [TM] ONE Directory Server 5.2 were installed from JES2 on the same box
    b) The server_root directory for Directory Server is the default: /var/opt/mps/serverroot
    c) The server_root directory for Messaging Server is also the default: /opt/SUNWmsgsr
    1. Login to the console and do a Certificate Request
    a) cd /var/opt/mps/serverroot
    b) ./startconsole &
    c) Login to the main console as "cn=Directory Manager"
    d) Select and open the "Messaging Server" console
    e) Highlight the tab called "Tasks" at the top
    f) Select "Manage Certificates"
    g) Console will ask for a password for the security database. Please enter a password twice and make sure that you remember it. This will create the following two files under "/var/opt/mps/serverroot/alias" directory:
    -rw------- 1 mailsrv other 65536 Aug 12 13:57 msg-config-cert8.db
    -rw------- 1 mailsrv other 32768 Aug 12 13:57 msg-config-key3.db
    NOTE: Please make sure that:
    - either the owner of the files is the messaging server user ( mailsrv in this case ),
    -or the permission is appropriate for the mail server user to at least read it.
    h) Once you reach the "Manage Certificate" window, please make a "Certificate Request" by filing up the appropriate questions
    i) Once you are done, you get a CSR , which looks something like this:
    -----BEGIN NEW CERTIFICATE REQUEST-----
    MIIBszCCARwCAQAwczELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3JuaWE x
    DzANBgNVBAcTBm5ld2FyazEMMAoGA1UEChMDc21pMQ0wCwYDVQQLEwRhdGFjMSEw
    HwYDVQQ DExhwb3BleWUuYXRhYy5lYmF5LnN1bi5jb20wgZ8wDQYJKoZIhvcNAQEB
    BQADgY0AMIGJAoGBALF eXVTFDj/1eONPzV/dAZ0dBKdstl+u+L/DTdw1sCXXOdNG
    MzYeTUu9g/g0dXL/bniF31M0OkoW+6O 5mshySv/KXS9QcoPngSKS6wuL8kNlYKQR
    Dw97WCS1uaqubAK/kir4hDmL7X9Rf29EFHDSFOWjeOJ /M7aqFWCfR5sTeSIFAgMB
    AAGgADANBgkqhkiG9w0BAQQFAAOBgQCeYwptiL/j7Bcs0DtGYiOlMMs utezF1COC
    4+wHt/p+LtQkvQWBoXisqN6YlGfZPXOCdUyA+RwU7BxjX9IQLP+9HLHfQyLzvCKb
    boKKpjIc8Ci+tmibM5QkgTxu4L7yeCR/PiplgVPttHNT2Qr9cxHLLBvIO6N1GOE8
    VBoq0pC5SA= =
    -----END NEW CERTIFICATE REQUEST-----
    Please maintain and preserve this CSR , since you will be sending it to the Certificate Authority ( CA ) so they can issue you a Certificate
    # openssl genrsa -des3 -out ca.key 4096
    # openssl req -new -x509 -days 3650 -key ca.key -out ca.crt
    # openssl x509 -req -days 3650 -in file.csr -CA ca.crt -CAkey ca.key -set_serial 01 -out server-cert.crt
    # cp -p /var/opt/mps/serverroot/alias/msg-config-key3.db key3.db
    # cp -p /var/opt/mps/serverroot/alias/msg-config-cert8.db cert8.db
    # cp -p /var/opt/mps/serverroot/alias/secmod.db .
    # cat sslpassword.conf
    Internal (Software) Token:password
    # cat /etc/opt/SUNWiim/default/config/iim.conf
    iim.comm.modules = "iim_server,iim_mux,iim_wd"
    iim.smtpserver = "www.esuria.com.bn"
    iim.instancedir = "/opt/SUNWiim"
    iim.instancevardir = "/var/opt/SUNWiim/default"
    iim.user = "root"
    iim.group = "root"
    iim.config.version = "1.1"
    iim_ldap.host = "www.esuria.com.bn:389"
    iim_ldap.searchbase = "o=esuria.com.bn,dc=esuria,dc=com,dc=bn"
    iim_ldap.loginfilter = "(&(objectclass=inetorgperson)(uid={0}))"
    iim_ldap.usergroupbyidsearchfilter = "(|(&(objectclass=groupofuniquenames)(dn={0
    }))(&(objectclass=inetorgperson)(uid={0})))"
    iim_ldap.usergroupbynamesearchfilter = "(|(&(objectclass=groupofuniquenames)(cn=
    {0}))(&(objectclass=inetorgperson)(cn={0})))"
    iim_ldap.allowwildcardinuid = "False"
    iim_ldap.userclass = "inetOrgPerson"
    iim_ldap.groupclass = "groupOfUniqueNames"
    iim_ldap.groupbrowsefilter = "(objectclass=groupofuniquenames)"
    iim_ldap.searchlimit = "40"
    iim_ldap.userdisplay = "cn"
    iim_ldap.groupdisplay = "cn"
    iim_ldap.useruidattr = "uid"
    iim_ldap.groupmemberattr = "uniquemember"
    iim_ldap.usermailattr = "mail"
    iim_ldap.resynctime = "720"
    iim_ldap.usergroupbinddn = "cn=Directory Manager"
    iim_ldap.usergroupbindcred = "password"
    iim_ldap.useidentityadmin = "false"
    iim.log.iim_server.severity = "INFO"
    iim.log.iim_mux.severity = "ERROR"
    iim.log.iim_wd.severity = "ERROR"
    iim_server.domainname = "esuria.com.bn"
    iim_server.useport = "True"
    iim_server.port = "5269"
    iim_server.usesslport = "False"
    iim_server.sslport = "5223"
    iim_server.enable = "True"
    iim_server.clienttimeout = "15"
    iim_server.usesso = "0"
    iim.policy.modules = "iim_ldap"
    iim.userprops.store = "file"
    iim_mux.listenport = "www.esuria.com.bn:5222"
    iim_mux.serverport = "www.esuria.com.bn:45222"
    iim_mux.enable = "true"
    iim_mux.numinstances = "2"
    iim_mux.maxthreads = "10"
    iim_mux.maxsessions = "1000"
    iim_mux.usessl = "on"
    iim_mux.secconfigdir = "/etc/opt/SUNWiim/default/config"
    iim_mux.keydbprefix =
    iim_mux.certdbprefix =
    iim_mux.secmodfile = "secmod.db"
    iim_mux.certnickname = "server-cert"
    iim_mux.keystorepasswordfile = "sslpassword.conf"
    iim_wd.enable = "true"
    iim_wd.period = "300"
    iim_wd.maxRetries = "10"
    -open http://www.esuria.com.bn/im/en/im.jnlp
    -click More Detail and enable Use SSL

  • Self signed cert in safari 4 and windows xp

    Hello there,
    in our company wi have an self signed certificate for testing purposes. over an automatic testing cenario will be tested an application with various browsers. safari under windows brings now an problem and does not accept the self signed cert. the running steps terminating at this point. importing in windows cert store is not helpful.
    has any one an solution to make this cert working with safari and windows? or exist an solution to disable the cert check in safari it self.
    thanks
    greetings
    vito21

    Hello Mick,
    sorry to be late, but may help someone other :)
    Setting:
    NumberFormat currencyFormat = NumberFormat.getCurrencyInstance();and:
    String value = currencyFormat.format(valToDisplay);you can now use value in any component and its view is correct.
    For some objects like files you also need to set the right charset (i.e. the one support the symbol you need).
    For the euro symbol try "windows-1250" as charset.
    Bye

  • Old clients won't switch from Self-Signed Certs to PKI.

    Greetings.
    I am wondering if anyone can give me advise on problem I am having with some of my sccm clients.
    When I originally deployed SCCM i used self signed certs on clients.
    We needed to add MAC and Linux support and MAC clients won't work without PKI, so I following this http://technet.microsoft.com/en-us/library/gg682023.aspx to configure Certificate Authority.
    It all seemed work well, I can now join MAC client with auto-enroll and all machines are requesting client certificates and I had couple of machine with new push on windows site installed with PKI.
    So right now I have about 250 windows clients, only 22 of them use PKI and the rest keeps using self-signed certs.
    I foolishly switched main site settings, MP settings and DP point settings to use https only.
    As a result I lost all self-signed clients and have full log for mpcontrol saying that it's rejecting clients cause they certificate cannot be validated.
    I logged in to couple of those machines and MMC i can see that it did enroll machine with valid Client Cert but Configuration Manager client itself still saying that it's using self signed one.
    Am I missing a step that I need to do to make sure that all those clients switch to PKI?

    It is. but how can i redeploy them?
    I was under impression auto push won't reinstall them. If i do deployment - that seem to reuse existing configuration and still use self signed on old machines.
    How can i verify that it does push clients to machine that already have it correctly and start using new config and not reuse old one.
    I even tried removing clients from couple of machines and see if it gets pushed again on them with proper config and those machines don't seem to get client but used to get it fine before. I keep getting new machines being added to domain and they get client
    pushed to them, but anything that had client with self signed doesn't seem to be happy.

  • E-Mail Setup fails with self-signed SSL certificat...

    Hi, one of my e-mails is with a small provider who just moved the mail server to Imap and SSL. In Thunderbird, everything works fine, setup on my Nokia C-6-fails with an unspecific error message (and trows away the settings). I asked the provider, and it seems that the problem comes up because the Nokia e-mail application doesn't asked me if I want to accept the certificate but instead rejects it. Is there a workaround to this problem? Is there a way to setup the mail account without using the wizard? Or to take over the settings from Thunderbird? Or a way to put the certificate in the right place manually? In Opera mobile I have no trouble with self-signed SSL certificates. Thanks Cave

    Any one around who can help? Self-Signed certificates are rather common, after all. I would be grateful cave

  • SCCM 2012 Default self signed Cert expired...

    SCCM 2012 Default self signed Cert expired - how do I renew it?

    The default selfsigned cert that gets generated with the installation - can be found in administration - security - Certificates  (This is Sccm 2012 RTM)
    Yes, I know this is an old post, but I’m trying to clean them up. Did you solve this problem, if so what was the solution?
    I will bring this back to Kent point, which one of the Certs are you talking about. You can see form the screenshot that I have 6 certs, 3 DP and 3 Boot cert. You can also see that the 3 DP server have a 100 year life and the 3 Boot certs only have 1 year.
    If you are talking about the boot certs then just create the boot image.
    Garth Jones | My blogs: Enhansoft and
    Old Blog site | Twitter:
    @GarthMJ

  • How do I allow self-signed cert for SecureAMF on iOS?

    I have spent the better part of two days trying to figure out how the dickens to do this. 
    Basically, I am using BlazeDS (using AMF as the protocol) to communicate with a Java backend (using tomcat with a self-signed cert).
    This works great in the browser version of the application (you usually get a little prompt saying that the site is untrusted when you try to access the website, you install the certificate and Bob's your uncle.)
    However, adapting the code over to iOS I am discovering a couple of problems.  The primary one being that the BlazeDS communication fails miserably when we are using SecureAMF with the self-signed certs.  It appears that it is similar to this issue: http://forums.adobe.com/message/3940214#3940214
    How do I get my iOS Air app to communicate with a self-signed certificate running on tomcat?
    Here are the things I've tried:
    1) Installing the cert using iPhone Configuration Utility
    2) Browsing to the site in Safari, and installing the certificate manually
    This is for development, so buying a certificate doesn't really make sense.
    So, any suggestions?

    Has anybody had any success here?  This is a real problem for testing internal applications inside of a local network.

  • EAP-GTC & self signed certs

    I am looking at deploying EAP-GTC with a novell ldap directory and ACS 3.3.4. Could I use a self signed cert with this or do have have to have a CA sign the cert? All clients will be Cisco aironet cards.

    Hi,
    Self signed certificate will be ok.
    Regards,
    Vivek

  • Weblogic self-signed certs

    Hi Guys, wanted to know whether it's ok to use self-signed certs in prod env when the weblogic server is sitting in DMZ including other down/up stream systems and end users will access the apps via protected proxy servers.

    Hi,
    Following is the standard way of creating self signed certificates..."keytool" is a utility which comes along with JDK installation.
    keytool -genkey -alias mykey -keyalg RSA -keysize 1024 -dname "CN=aaa.bbb.com, OU=Customer Support, O=MyOrganization, L=Denver, ST=Colorado, C=US" -keypass mykeypass -keystore identity.jks -storepass mystorepass
    keytool -selfcert -v -alias <alias> -keypass -keystore .jks -storepass <store password> -storetype jks
    keytool -export -v -alias <alias;> -file <root cert>.der -keystore <key store>.jks -storepass
    keytool -import -v -trustcacerts -alias <alias> -file <root cert>.der -keystore <key store>.jks -storepass
    for detailed informations please visit: http://java.sun.com/j2se/1.5.0/docs/tooldocs/windows/keytool.html
    Thanks
    Jay SenSharma
    http://jaysensharma.wordpress.com (WebLogic Wonders Are Here)
    Edited by: Jay SenSharma on Feb 4, 2010 5:00 PM

Maybe you are looking for