mail.orcon.net.nz SSL cert invalid?

Forums › 2degrees (including Slingshot, Orcon, Flip, Stuff Fibre, MyRepublic, 2talk and Vocus) › mail.orcon.net.nz SSL cert invalid?

rattewisday

203 posts

Master Geek

#112582 13-Dec-2012 10:25

Hi there,

I am having issues using POP3 through Gmail to pull in my @orcon.net.nz emails. Taking a closer look it appears the SSL certificate for mail.orcon.net.nz is invalid. It works fine if I disable SSL, but I would prefer to keep this enabled. I thought it would be easier to get the right peoples attention by posting on here, rather than calling the helpdesk. :-)

EDIT: Hmm taking a closer look it seems the cert is valid through to May 10 03:11:21 2017 GMT. Perhaps I'm having another issue, or there is something wrong with the chain of authority?

The specific error I get from Gmail is:

Unable to establish secure SSL connection to mail.orcon.net.nz [ Help ]

rattewisday

203 posts

Master Geek

#731863 13-Dec-2012 10:33

Plugging mail.orcon.net.nz:995 in to this website gives some more specific info:

http://www.digicert.com/help/

ubergeeknz

3344 posts

Uber Geek

Trusted

Vocus

#731865 13-Dec-2012 10:37

Hi There,

I've just taken a quick look and all the certs look valid (POP3, IMAP, SMTP). What makes you suspect a certificate problem?

Cheers

Dan

rattewisday

203 posts

Master Geek

#731872 13-Dec-2012 10:40

ubergeeknz: Hi There,

I've just taken a quick look and all the certs look valid (POP3, IMAP, SMTP). What makes you suspect a certificate problem?

Cheers

Dan

Hi Dan,

It seems something has changed on either Gmail's or Orcon's side as POP3 from Gmail (with SSL enabled) has been working for several months up to this point. The website I mentioned above shows "SSL certificate is not trusted" - is this normal?

Thanks for taking a look!

ubergeeknz

3344 posts

Uber Geek

Trusted

Vocus

#731874 13-Dec-2012 10:42

Update: Seems like the mail server is missing an intermediate cert. The guys are looking into it now.

bagheera

539 posts

Ultimate Geek

#731876 13-Dec-2012 10:43

looking at the cert - the key chain not load right on orcon side for one or more Intermediate certificates - orcon techs will need to fix that - good luck.

also look like it a new cert so that why it just stop working for you - new chained cert can be a real pain in the a$$ to install, even bigger pain if it microsoft server as some time even loaded right it still does not work.

ubergeeknz

3344 posts

Uber Geek

Trusted

Vocus

#731879 13-Dec-2012 10:46

bagheera: looking at the cert - the key chain not load right on orcon side for one or more Intermediate certificates - orcon techs will need to fix that - good luck.

SNAP

richms

28168 posts

Uber Geek

Trusted

Lifetime subscriber

#732264 13-Dec-2012 20:41

Can you not force gmail to accept the cert? Seems a bit broken as a client if it only trusts the pre-baked CA's and not self signed

Richard rich.ms

Equinox IT

Cloud spending continues to surge globally, but most organisations haven’t made the changes necessary to maximise the value and cost-efficiency benefits of their cloud investments. Download the whitepaper From Overspend to Advantage now.

rattewisday

203 posts

Master Geek

#732277 13-Dec-2012 21:31

richms: Can you not force gmail to accept the cert? Seems a bit broken as a client if it only trusts the pre-baked CA's and not self signed

No, unfortunately they don't allow that. Thanks for getting them to take a look Dan

bagheera

539 posts

Ultimate Geek

#732372 14-Dec-2012 08:37

richms: Can you not force gmail to accept the cert? Seems a bit broken as a client if it only trusts the pre-baked CA's and not self signed

having a self sign cert for mail is a bad idea - there alot of phone and other client you can not tell to trust the cert with. This problem is due to the cert not load right, will most like work for a window pc only, but fail on all apple os, android etc. due to how they do cert vs Microsoft.

bagheera

539 posts

Ultimate Geek

#732495 14-Dec-2012 11:38

look like the tech has updated the chain now. Should be working now.

rattewisday

203 posts

Master Geek

#732508 14-Dec-2012 11:41

bagheera: look like the tech has updated the chain now. Should be working now.

Yes all fixed now. Thanks for the quick turn around Orcon!

ubergeeknz

3344 posts

Uber Geek

Trusted

Vocus

#732510 14-Dec-2012 11:44

Hi Guys,

Should be all fixed now. Sorry for the inconvenience, and thanks for letting us know...

Regards

Dan

richms

28168 posts

Uber Geek

Trusted

Lifetime subscriber

#732745 14-Dec-2012 20:04

bagheera:
richms: Can you not force gmail to accept the cert? Seems a bit broken as a client if it only trusts the pre-baked CA's and not self signed

having a self sign cert for mail is a bad idea - there alot of phone and other client you can not tell to trust the cert with. This problem is due to the cert not load right, will most like work for a window pc only, but fail on all apple os, android etc. due to how they do cert vs Microsoft.

works for me with the default control panels cert as well as one I made on my home machine and put on a web hoat. just have to accept once.

unfortunatly there was no warning from the phone or outlook when one was swapped out for a cheap ssl cert from go daddy or someone.

Richard rich.ms