Like recent versions of Internet Explorer, Version 9 has a Microsoft-style way of handling SSL certificates. It won’t let lusers access anything over a secure connection if there’s anything wrong with the certificate the remote end has presented. On the face of it, this is all very reasonable, as you don’t want the lusers being tricked by nasty criminals. But in reality it’s not as simple as that.
A bit of background, because everyone should make an informed choice about this…
SSL (or TLS) has two purposes – authentication and encryption. When you send data over SSL then it’s only readable by the receiving computer (i.e. it’s encrypted), and you know you’re talking to the right one (the link is authenticated). The computers don’t exactly exchange passwords, but they have a way of recognising each other’s SSL certificate. Put simply, if two computers need to talk they have a copy of each other’s certificate stored on their disk and they use these to recognise each other (gross over-simplification, but it’s a paradigm that works). Should a computer not have the certificate needed to authenticate the other end ti will be supplied, and this is checked to see if its “signed” by a certificate it already has – in other words, the unknown remote certificate arrives and the comptuer checks with a “signing authority” certificate to see if it’s been signed, and is therefore to be trusted. If it’s okay, it’s stored and used.
Now here’s where it breaks in Microsoft-land: For your computer’s certificate (the one it sends) to be signed by a “signing authority”, money has to change hands. Quite a lot of money, in fact.
In he rest of the world (where SSL came from), on receipt of an unknown certificate, you’d see a message saying that the remote computer says it can be recognised using the supplied certificate, but we’ve never seen it before: Do we trust it? In most cases the answer would be “yes” and the two comptuers become known to each other on subsequent connections. It’s okay to do this – it’s normal. Something like this happens on Windows with Firefox and other browsers, but not, apparently, Internet Explorer. Actually, Internet Explorer 9 can be made to recognise unsigned securty certificates, and here’s how.
First off, we really need to know what we’re about to do. What are the symptoms? The address bar goes red and you get a page saying there’s a problem with the certificate every time you visit a “site”. You can click on somethign to proceed anyway. The “error” is normally for on of three reasons, and it’ll tell you which. On a bad day you might get all three! But taking them in turn:
“The security certificate presented by this website was not issued by a trusted certificate authority.”
This just means that no one has paid to have this certificate signed by anyone of Microsoft’s likeing. It may be a private company-wide certificate, or that belonging to a peice of network equipment such as a router. If it’s a web site belonging to your bank or an on-line shop, worry! Otherwise, if there’s a reason why someone isn’t paying to have their certificate approved by (indirectly) by Microsoft, make your own decision as to whether you trust it.
So how do you get around it? Actually it’s pretty simple but Microsoft aren’t gibing out any clues! The trick is to run Internet Explorer as Administrator (not just when logged in as Administrator). If you don’t, the following won’t work.
Go to the site who’s certificate you wish to import, and proceed to view the site in spite of the warnings. Then in the address bar you’ll see “Certificate error”. Click on this and you’ll see an option to “View Certificate”, and (assuming you’re in Administrator mode) there’s be a button the “General” tab to “Install Certificate”. Follow the prompts. For maximum effectiveness(!) choose the option to “Place all certificates in…” and browse to the “Trusted Root Certification Authorities”. This probably isn’t necessary in most cases, but if you do this it’ll cover you for pretty much every use. Your PC will happily accept anything from the remote machine hereafter; make sure you’re importing the right certificate!
“The security certificate presented by this website has expired or is not yet valid.”
This means the certificate is out-of-date, or exceptionally, too new. In most cases encountering a certificate that isn’t valid suggests that your comptuer’s clock has gone back to the 1980′s! If this sounds plausible, just proceed to use the certificate anyway (there’s a clear option on the screen to do this). You’ll still get a scary red address bar, but the server operator should fix this.
“The security certificate presented by this website was issued for a different website’s address”.
This third case is a bit more tricky. Basically the name of the comptuer is embedded into the certificate, but you might be calling it by another name. Or it could be using a pinched certificate. If you’re talking to a network router like a Draytek 2820 and it’s giving you a built-in certificate, it would have no way of knowing what name or address the router is ultimately going to be installed as. The certificate is bound to be wrong in this respect. However, fishing around in the Internet Explorer options, under Advanced (and right down near the bottom) there’s a check-box – “Warn about certificate name mismatches”. Un-check it and it’ll stop sqwarking. Unfortunately it’s either on or off; you can’t set it to ignore a mis-match for particular names only. Because of the risk that someone might be impersonating your bank, you’d probably be best to leave this one checked and put up with the red.
Final word of warning
Some people reading this will reckon this advice is reckless. Why circumvent a security feature? Simple – if the authentication part of SSL isn’t working you still want it for the encryption. In an ideal world everyone would have signed certificates so you can verify everything you talk to is what it claims to be (the first time you meet it) but in the real world you probably want your data encrypted, and it’s also good to know you’re talking to the same comptuer on subsequent visits.
Hassling everyone over security certificates, as Microsoft is doing, may be justifyable on some levels, but as far as I’m concerned, anything that makes the use of encrypted data paths more difficult or expensive is a bad thing. They’re throwiing the baby out with the bathwater.
