SSL certificate authentication using Microsoft Internet Explorer

[Jil MacMenamin_1]

I have a Linux tomcat server, my classmate & I have created a certificate that is recognized by Mac & Netscape, but IE just hangs. I have tried to manually add the "Trusted Site" in IE using: Settings, Control Panel, Internet Options, Security, Trusted Sites, and adding:

https://216.114.150.51:8080/PL2secure/secure.jsp

I have tried to use the Microsoft Forums, but they are not user friendly. I'm hoping someone could point me in the right direction. My Thesis is for the YMCA, and we don't have funding for a $$ certificate.

Thank you in advance

JilMac

[Roger Faucher]

Jil:

In IE under Tools/Internet Options, select the Advanced tab and try checking the Use SSL 2.0 and Use SSL 3.0 boxes under Security (near the bottom of the list).

HTH!

Roger

[Jil MacMenamin_1]

Hi Roger, My Internet Explorer already had 2.0 and 3.0 checked (we did check that out at school with the professor), were you able to get the login screen from our URL with IE??

Thanks - JilMac

[Roger Faucher]

Jil:

Using the URL you posted, it just churns and churns. I punched in this (http://216.114.150.51:8080/index.jsp) and see a page with this message: "If you're seeing this page via a web browser, it means you've setup Tomcat successfully. Congratulations!"

Then I tried http://216.114.150.51:8080/PL2secure/index.html and got a page with the following items:
Go to Public page

Go to User secure page

Go to Admin secure page

Log Out

When I select Go to User secure page OR Go to Admin secure page, I get the churning. The very first time I tried it, I got a Microsoft certificate error dialog box. I did not record it since I figured I'd be able to duplicate it at will. Not so, unfortunately, I never saw it again.

Jil, I'm sorry I can't work on this anymore tonight - it's almost 2AM. I hope something here gives you an AHA moment.

Good luck!

Roger

[Sergejs Svitnevs]

Hi,

If you have users with MS IE 4.0+ and want them to be able to install the certificate into their certificate storage (by downloading and opening it), you need to create a DER-encoded version of the certificate.
Example:
openssl x509 -in server.crt -out server.der.crt -outform DER.

Regards,
Sergejs

[Jil MacMenamin_1]

Thanks for your answers Robert & Sergeis:

I didn't want to assign points until I had the problem solved.

It turned out that I was creating the certificates ok in Linux using:
$JAVA_HOME/bin/keytool

But I had incorrectly set a parameter in my server.xml file on my tomcat server.
It now correctly displays the login window:
https://216.114.150.56:8443/YMCAssl/YMCAloginpage.html

You could only see the error from Windows, so I assumed that I wasn't accepting the certificate correctly.

Your answers were very helpful, not by directly solving my problem, but in giving me confidence that what I was doing on the Windows side was correct. Thank you for your encouragement. They were very much appreciated.

JilMac MSIE'03 student