SSL Certificate Chains

Summary

JEMHC runs on Java, which includes a set of root Certificate Authority (CA) certs.  If you are lucky enough to have an SSL certificate issued by a root CA, you're done, otherwise, a self-signed or 3rd party certificate chain needs to be extracted and made available to JEMHC in order for SSL connections to be established.  This page shows how an SSL servers trust-chain can be extracted and uploaded to JEMHC.

In the following example, the ROOT CA signs the 3rd party CA certificate, which in turn uses an Intermediate CA certificate to sign user SSL certificates.  In order for JEMHC to validate Your SSL certificate, it must have the entire chain up to the ROOT CA.  In some cases, the root CA is signed by itself (self-signed).

• ROOT Certificate Authority (CA)                 <---------------------------- First (required)

  • example 3rd party CA                       <---------------------------- Second (required)

    • example Intermediate CA       <---------------------------- Third (required)

      • Your SSL certificate

Adding a Custom SSL certificates

The following shows how to get the certificate chain for a given SSL service.  There are two approaches, the first is automated, if there are problems, a manual approach is also given (linux oriented) if you use windows, ask your network administrator for the certificate chain.

Services

• Gmail - https://support.google.com/a/answer/176600?hl=en

• Office365 - https://support.office.com/en-US/Article/Settings-for-POP-and-IMAP-access-for-Office-365-for-business-or-Microsoft-Exchange-accounts-7fc677eb-2491-4cbc-8153-8e7113525f6c?ui=en-US

• Windows Live (eg @outlook.com) - Add your Outlook.com account to another mail app or smart device - Microsoft Support

CA Chain extraction: The Easy Way

JEMHC can extract an SSL certificates signing chain, and store them in JEMHC for later use to validate the SSL connection.  

Navigate to Messaging > Certificates : SSL Certificate Chains and select Create:

Open

Give the CA Chain a name (remember it may not be just usable for pops, but could also be used for imaps, and smtps) and set a Test Host (e.g. pop.gmail.com) and the connection port.  When set, click the Download Certificate button to get the chain.

Open

 If connectivity is OK, the servers signing chain will be added to the Certificate section, including key details of the cert:

Once a chain has content, it can be re-tested as well as submitted, where it will be listed in the SSL Certicficate Chains section.  the certificate detail can be seen through the expandable (1) , the connection can also be retested (2).

Testing

Testing the configuration can throw up a warning, shown below, which means the CA chain found a certificate that is already bundled with the default JAVA runtime, its less efficient to duplicate this by may be required when there are intermediate certs.

CA Chain extraction: The Linux Cmdline way

Issue the following command in a linux environment:

openssl s_client -host HOST -port PORT -prexit -showcerts

Output from that will be, for smtp:

The user certificate above has the same CN as the host we are connecting to, in this case, pop.google.com.  This certificate is the site certificate, not a signer, it should not be uploaded.

The remaining chain that JEMHC therefore needs in order to validate the site SSL certificate is:

Referring a SSL Certificate Chain in Inbound/Outbound config

In Message Sources and Message Outbound configurations, a new parameter can be set when SSL is enabled.  The SSL Certificate Validation field can have 3 values:

• JAVA Default CA Chain, this lists at last count around 87 CA's that are included in the JAVA runtime (cacerts) file, these are sufficient for most 'global' services, eg gmail.

• User Supplied CA Chain, this selects one of the previously created CA chains.  When a given chain is selected, only the CA's therein are used (global CA list is not included)

• Trust All Certificates, this is for diagnosis only.  Trusting ALL remote SSL certificates opens up the possibility (unlikely but possible!) of a man-in-the-middle attack to expose your traffic between JEMHC and your mail server.

  After selecting the User Supplied CA Chain option, a further select is then available for the SSL Certificate Chain:

  Once the CA chain has been selected (1) , the connection can be tested (2), resulting in some brief information on waiting messages