Certificate “Errors” on Internet Explorer 9 – and how to stop them

Like recent versions of Internet Explorer, Version 9 has a Microsoft-style way of handling SSL certificates. It won’t let lusers access anything over a secure connection if there’s anything wrong with the certificate the remote end has presented. On the face of it, this is all very reasonable, as you don’t want the lusers being tricked by nasty criminals. But in reality it’s not as simple as that.

A bit of background, because everyone should make an informed choice about this…

SSL (or TLS) has two purposes – authentication and encryption. When you send data over SSL then two things occur. Firstly it’s only readable by the receiving computer (i.e. it’s encrypted), and secondly you know you’re talking to the right server (the link is authenticated – both computers recognise each other). The computers don’t exactly exchange passwords, but they have a way of recognising each other’s SSL certificate. Put simply, if two computers need to talk they have a copy of each other’s certificate stored on their disk  and they use to make sure they’re not talking to an impostor (gross over-simplification, but it’s a paradigm that works). Should one computer not have the certificate needed to authenticate the other end it will be supplied, and this is supplied certificate is checked to see if its “signed” by an “signing authority” using a certificate it does already have has. In other words, the unknown remote certificate arrives and the computer checks with a “signing authority” certificate to see if it’s been signed, and is therefore to be trusted. If it’s okay, it’s stored and used.

Now here’s where it breaks in Microsoft-land: For your computer’s certificate (the one it sends) to be signed by a “signing authority”, money has to change hands. Quite a lot of money, in fact. If it’s not signed, the recipient will have no way of knowing it’s really you.

In the rest of the world (where SSL came from), on receipt of an unknown certificate,  you’d see a message saying that the remote computer says it can be recognised using the supplied certificate, but I’ve never seen it before: Do we trust it? In most cases the answer would be “yes” and the two computers become known to each other on subsequent connections. It’s okay to do this – it’s normal. Something like this happens on Windows with Firefox and other browsers, but not, apparently, Internet Explorer. Not until you did a bit deeper, anyway. Actually, Internet Explorer 9 can be made to recognise unsigned security certificates, and here’s how.

First off, we really need to know what we’re about to do. What are the symptoms? The address bar goes red and you get a page saying there’s a problem with the certificate every time you visit a “site”. You can click on something to proceed anyway, but the implication is that you’re heading for your doom. The “error” message you see is normally for one of three reasons, and reading it might be enlightening. On a bad day you might get all three! But taking them in turn:

“The security certificate presented by this website was not issued by a trusted certificate authority.”

This just means that no one has paid to have this certificate signed by anyone of Microsoft’s liking. It may be a private company-wide certificate, or that belonging to a piece of network equipment such as a router. If it’s a web site belonging to your bank or an on-line shop, then you should be worried! Otherwise, if there’s a reason why someone isn’t paying to have their certificate approved (indirectly) by Microsoft, make your own decision as to whether you trust it.

Please generate and paste your ad code here. If left empty, the ad location will be highlighted on your blog pages with a reminder to enter your code. Mid-Post

So how do you get around it? Actually it’s pretty simple but Microsoft aren’t giving out any clues! The trick is to run Internet Explorer as Administrator (not just when logged in as Administrator).  In current versions of Windows you do this by right-clicking on IE in the start menu and selecting “Run as Administrator” from the pop-up menu. If you don’t, the following won’t work.

Go to the site who’s certificate you wish to import, and proceed to view the site in spite of the warnings. Then in the address bar you’ll see “Certificate error”. Click on this and you’ll see an option to “View Certificate”, and (assuming you’re in Administrator mode) there’s be a button the “General” tab to “Install Certificate”. Follow the prompts. For maximum effectiveness(!) choose the option to “Place all certificates in…” and browse to the “Trusted Root Certification Authorities”. This probably isn’t necessary in most cases, but if you do this it’ll cover you for pretty much every use. Your PC will happily accept anything from the remote machine hereafter; so make sure you’re importing the right certificate!

“The security certificate presented by this website has expired or is not yet valid.”

This means the certificate is out-of-date, or exceptionally, too new. In most cases encountering a certificate that isn’t valid suggests that your computer’s clock has reset itself to 1980. If this sounds plausible, just proceed to use the certificate anyway (there’s a clear option on the screen to do this). You’ll still get a scary red address bar, then it’s up to the server operator to fix this, but before you get on the ‘phone and give them what for, make sure you’re computer’s idea of the time and date is actually correct.

“The security certificate presented by this website was issued for a different website’s address”

This third case is a bit more tricky. Basically the name of the computer is embedded into the certificate, but you might be referring to it by another name (i.e. an alias). Or it could be using a pinched certificate. If you’re talking to a network router like a Draytek 2820 by going to its IP address and it’s giving you a built-in certificate, it would have no way of knowing what name or address the router is ultimately going end up on. The certificate is bound to be wrong in this respect. However, fishing around in the Internet Explorer options, under Advanced (and right down near the bottom) there’s a check-box – “Warn about certificate name mismatches”. Un-check it and it’ll stop squawking. Unfortunately it’s either on or off; you can’t set it to ignore a mis-match for particular names only. Because of the risk that someone might be impersonating your bank, you’d probably be best to leave this one checked and put up with the red warnings.

Final word of warning

Some people reading this will reckon this advice is reckless. Why circumvent a security feature? Simple – if the authentication part of SSL isn’t working you still want it for the encryption. In an ideal world everyone would have signed certificates so you can verify everything you talk and know it’s what it claims to be the first time you meet it. Subsequent visits will be authenticated with your newly installed certificate, so if something turns up impersonating it alter it’ll be detected. In the real world you probably want your data encrypted regardless. A signed certificate is better, but not that much better.

Hassling everyone over security certificates, as Microsoft is doing, may be justifiable on some levels, but as far as I’m concerned, anything that makes the use of encrypted data paths more difficult or expensive to use than they need be is a bad thing. They’re throwing the baby out with the bathwater.

 

Unified Communications 2012

This year’s Unified Communications show was pretty much like last year’s at least on the face of it. It’s another event defined by a buzzword; probably worth attending if you’re looking to by or sell unified communications, whatever that means. In practice you’ll find a wide choice of telephony headsets and IP VoIP endpoints (handsets) all under one roof.
Look a little closer, and this year every stand was flogging solutions involving Microsoft Lync. Microsoft what? In case you missed it, this is the new name for Microsoft Office Communicator, designed to sort out (unifiy) the bugger’s muddle they helped create with a every new IM and/or VoIP protocol released over many years. But because it’s a Microsoft product, everyone is falling over themselves to support it.
As far as I can make out, Lync is pretty much just Microsoft’s interpretation of SIP, with particular optional extension to the open standard considered by Microsoft to be mandatory. Unifying it with Skype isn’t on the cards, yet. Making some kind of sense of MSN Messenger and their various other IM protocols is; as is integration with Exchange Server for directory information.
Comapnies which once offered Asterisk in the cloud are now racing to offer Lync Servers, and as usual these are virtual products ultimately purchased from providers like SIPCOM, who actually have the hardware at the data centres and resell as a white-box product.
Another real hardware comany at the show was my old friends Snom, the German IP PABX makers. They’re offering a range of Lync compatible handsets, but with a significant twist. Microsoft recognises both “Lync Optimized”, and “Lync Qualified” handsets. Basically “Optimised” means you’re running a Microsoft Lync Client bastartised SIP stack, which won’t talk to much else. “Qualified” means you’re running standards-based SIP with the required optional extensions needed to talk to Lync Server. Snom offer both options, and have some dual-stack products that’ll register accounts with standard SIP and Lync at the same time. As handsets are a significant cost, going for the dual-stack option looks a much safer bet than throwing in with Microsoft. And here’s why…
Ask yourself the question – how long do you expect your company telephone system to last? Five years, ten years, twenty years? The longer the better. Now look again at Microsoft’s business model – they’ve got form. How long to their software products last before they’re considered to be junk, even my Microsoft? Well Windows 2000 lasted five years, Server 2003 lasted five years (Server 2000 even less), Windows NT 6 looks set to be replaced after five years too. In short, Microsoft is a software company and doesn’t see any point in supporting products longer than they have to – it’s software, after all – easy to upgrade, right? With that in mind, buying tens ot fhousands of pounds worth of Lync-only hardware might not be such a bright idea.

Another company I ran into at Integrated Comms 2012 was Draytek (UK), showing off their latest ADSL routers. I favour Draytek routers, and have done for many years. Sometimes this is hard, when new models with improvements lead to degredation and the technical documeation stops at a level just when it starts to get interesting. But put simply, they don’t have a lot of competition in the niche they operate it and their current products work really well and do a lot more than everyone elses, aspart from Cisco kit (which is expensive and needs a specialist to configure).
Their latest ADSL boxes are the 2830 and the 2850. The 2830 is an upgrade of of the 2820: new firewall and VLAN features and every port on the switch is now 1Gb. More intersting is the 2850, which has a VDSL modem built in. That’s FTTC (or BT Infinity) in case you were wondering. You can connect a 2850 to the wall, without using the BT Ethernet modem box you currently get to connect your “Home Hub”. You can also connect the BT modem to the WAN port on a 2820 or 2830 and configure PPPoE – it works just fine, and as you get one free this might seem unnecessary, but the 2850 is an all-in-one solution and when the FTTC market opens up or your BT modem breaks down.

VoIP socket pinout on newer Draytek routers (2820Vn etc)

I’ve just spent over a day trying to get this piece of information out of Draytek, so appreciate it!

On the newer Draytek routers with VoIP capabilities (Vigor 2820 and some of the later ones) you no longer connect the handset (or PABX) to a standard RJ11. Instead both analogue lines come out on a single RJ11/RJ12, and you get an adapter so you can plug two standard BT handsets in to it. I assume this only applies to UK models. Anyway, if you’re wiring to a PABX, BT jacks are a complete pain in the rear, so if you want to connect an RJ11 to a twin-pair cable and go directly to a krone block the pin-out is (officially):

  • Line 1 – pins 2 and 5 (centre two)
  • Line 2 – pins 3 and 4 (one out from centre, or outer on RJ11)

That is to say the middle two pins and the two straddling – and numbering as if it was an RJ12 with six positions, even though the contacts may be missing from an RJ11. Heck, if you don’t know how to number an RJ12 you’re probably better off with the BT jacks.

This is logical and probably most telecoms people’s first guess, but it’s nice not to have to go for trial an error or smash their adapter apart (assuming you can’t connect an AVO into a BT-style socket conveniently).

For what it’s worth, I’ve been using Draytek VoIP kit for about eight years now – some of the best going in the market it serves, and I’ve got rather a lot to compare with. It’s a pity the company is so hard to get hold of for technical support as they won’t answer a general question straddling the product range – only individual serial-numbered units. Therefore I can’t get a list of kit for which this applies – I need to ask them one at a time giving the serial number of an extant unit. I suspect they don’t want too many dumb questions swamping them, but not  so brilliant for professional users though – if it’s not in their FAQ you’re left to trial-and-error.

HP Microserver and WOL

Update: See article here

 

They just don’t seem to work. I’ve spent an annoying hour or so trying to get WOL to work with an HP Microserver – no joy whatsoever. I assumed it must be my code until I tried it on a few other machines but they worked just fine.

Now most of my machines are Realtek whereas HP are using Broadcom (as do the Dells). I’m not saying there’s anything wrong with Broadcom, but whenever I have a weird network problem they have a habit of being at the heart of it. Is it my magic packet? As far as I know it’s supposed to be 48-bits of ‘1’ followed by sixteen copies of the MAC address. Does it need a secure-on password? If so, how come you can’t set one in the BIOS.

I’ve asked an HP server expert: “Update the BIOS”. Perhaps, but these are brand new machines of an established design. They either turn on when they receive the packet, or they don’t work, and I can’t believe HP didn’t test them. Then again…

I’m told that these do support WOL on Windows, but not if you’re running anything else. On the face of it this is bonkers. Why should the OS the powered-off drive affect anything. The machine is off; the OS isn’t running. Well here’s a theory – before Windows shuts off it puts something in a register on the Broadcom chip to leave it in a WOL state. With the wrong drivers this doesn’t happen. Setting it in the BIOS doesn’t help, because it’s erased by the OS driver. The BIOS doesn’t restore it as the power is killed, but Windows hits the registers differently.

Unfortunately Broadcom doesn’t seem keen on releasing the documentation needed to write proper drivers to anyone other than Microsoft. Is this my imagination? Everyone else publishes the reference material, but Broadcom – I can’t find it.

If anyone can throw light on this one, please do. I’m still looking.

Update

Fitting a Realtek-based NIC in the Microserver and using that instead solves the problem. WOL just works. If you’re going to order one, remember it’s PCIe, not PCI, and that you really need one with a low-profile bracket option because a full-height card won’t fit.

 Further Update: See article here