Add missing issuer certificates

<< Click to Display Table of Contents >>

Navigation:  Certificates >

Add missing issuer certificates

SecureTCPIP_014

 

For a (not self signed) certificate to validate successfully, all required issuer certificates have to be present in one of !MC5s validation sources. !MC5 uses up to four different validation sources: Windows' certificate storage, the in !MC5 included default store, Trusted Service Status Lists downloadable via internet and user defined  certificates. Which of these are used can be specified using the Security settings. User defined certificates are always being used.

 

So if a partners certificate cannot be validated because of a missing issuer certificate you can try to activate additional validation sources or install the required issuer certificates manually.

 

Determination of the required issuer certificates

 

SecureTCPIP_015

 

To validate a not self signed certificate at leat one issuer certificate is needed, in most cases two are needed, one CA certificate (Certificate Authority) and one root certificate, and some cases require even more than two. All these certificates form a certificate chain, beginning at the root certificate up to the partners certificate, each certificate signed by the previous certificate in the chain, except the root certificate, which is self signed. When viewing a certificate in !MC5s certificate preview the common name of the directly preceding certificate in this chain is displayed two times as "Issued by" and "Issuer". To successfully validate the certificate the iusser certificate with exactly the displayed common name has to be present in one validation source.

 

Additionally to their own certificate partners will often send you the required root and CA certificates, which most times contain "Root" or "CA" in their file name. If your partner doesn't send you the required issuer certificates you can try to download them from the issuers website for which you might have to search on the internet. When downloading certificates from the internet always make sure to only download from trusted websites!

 

Install user defined issuer certificates

 

SecureTCPIP_016

 

When you ave the required issuer certificates you can install them in the settings using Settings / !MC5 / Security / Certificates. You have to start installing the root certificate, followed by the CA certificate. Trying to import in the wrong sequence will cause validation errors while importing. When all required issuer certificates are installed you can import the partners certificate without validation errors.