This menu is used to manage the position of trust for the individual certification authorities (CA).
Sections on this page:
•Root certificate with verification errors
During installation, the root CA certificates of the usual accredited CAs are already pre-installed (see also Trust state set by) similar to internet browsers, for example. If necessary, this existing list can be compared with any existing revision specifications and, under certain circumstances, the trust of undesirable CAs can be withdrawn. This means that SEPPmail does not make any further changes here, not even for updates, for example. This prevents undesired manipulation of the safety concept of the respective operator.
From installation onwards, the system grows dynamically at this point. If the SEPPmail Secure E-Mail Gateway receives signed emails whose signature certificates originate from unknown certification authorities, root and intermediate certificates from these signatures are collected if necessary and saved with the status "?" (unknown). In this event, members of Groups x509rootcertificatesadmin will receive an email notification with the subject "IMPORTANT: SEPPmail new CA certificates added on ...". This information is also included in the Daily Report, which thus has the status "IMPORTANT:" and is therefore also sent to the members of the Groups admins and the Postmaster address.
Subsequently, an administrator should classify these certificates with regard to their trustworthiness.
The Import S/MIME root certificate... button opens the submenu for the import of individual or several (bulk) certificates of communication partners.
The Advanced settings... button opens the . This can be used to set how X.509 root certificates are to be handled.
The input field with the Filter... button is used for searching for corresponding keys based on the characteristics indicated in the table. The search term is entered as a character string.
The root and intermediate certificates are displayed as follows:
Column |
Description |
||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Shows the trust status. Possible statuses are
If the status is unknown ("?"), the administrator must intervene. The administrator must decide whether the certification authority should be trusted or not. If certificates with the status "?" are present, these are reported to the CA administrators (see Groups caadmin) and – as part of the Daily Report, which then receives the status "IMPORTANT:" – to the machine administrators (see Groups admin) on appearance. By clicking on the trust status of the certificate, details can be viewed and the trust status can be changed (see submenu ).
|
|||||||||||||||||
Specifies the name (CN) of the applicant |
|||||||||||||||||
|
(new in 12.1) |
Displays who issued the certificate.
|
||||||||||||||||
Issue date of the certificate in the form YYYY-MM-DD |
|||||||||||||||||
Expiration date of the certificate in the form YYYY-MM-DD |
|||||||||||||||||
Displays the fingerprint (hash) of the certificate. |
|||||||||||||||||
Specifies the hash of the certificate. For example RSA-MD5, RSA-SHA1, RSA-SHA256,... |
|||||||||||||||||
Specifies the validity of the certificate. Possible statuses are •"none", which means "OK". •REVOKED •EXPIRED |
|||||||||||||||||
Result of the OCSP/CRL check. Possible statuses are •OK •? •uncheckable •uncheckable (no supported CRL/OCSP mechanism) •revoked |
Section Root certificate with verification errors
(new in 12.1)
The root and intermediate certificates are displayed as follows:
Column |
Description |
|---|---|
see Root certificate Type |
|
Shows the reason why a certificate is invalid
|
|
