%brandDTD; ]>
This document is provided for your information only. It may help you take certain steps to protect the privacy and security of your personal information on the Internet. This document does not, however, address all online privacy and security issues, nor does it represent a recommendation about what constitutes adequate privacy and security protection on the Internet.

# Certificate Information and Decisions

This section describes how to use various windows displayed at different times by Certificate Manager. The additional information given here appears when you click the Help button in one of those windows.

In this section:

- Certificate Viewer
- Choose Security Device
- Encryption Key Copy
- Certificate Backup
- User Identification Request
- New Certificate Authority
- Web Site Certificates

## Certificate Viewer

The Certificate Viewer displays information about a certificate you selected in one of the Certificate Manager tabs. The General tab summarises information about who issued the certificate, its verification status, what the certificate can be used for, and so on. The Details tab provides complete details on the certificate's contents.

If you are not currently viewing the Certificate Viewer, follow these steps:

1. Open the &brandShortName; Edit menu and choose Preferences.
2. Under the Privacy & Security category, click Certificates. (If no subcategories are visible, double-click Privacy & Security to expand the list.)
3. Click Manage Certificates.
4. Click the tab for the type of certificate whose details you want to view.
5. Select the certificate whose details you want to view.
6. Click View.

In this section:

- General Tab
- Details Tab

### General Tab

When you first open the Certificate Viewer, the General tab displays several kinds of information about the selected certificate:

- This certificate has been verified for the following uses: See certificate verification for a discussion of how the Certificate Manager verifies certificates. Uses can include any of the following:
  - SSL Client Certificate: Certificate used to identify you to web sites.
  - SSL Server Certificate: Certificate used to identify a web site server to browsers.
  - Email Signer Certificate: Certificate used to identify you for the purposes of digitally signing email messages.
  - Email Recipient Certificate: Certificate used to identify someone else, for example so you can send that person encrypted email.
  - Status Responder Certificate: Certificate used to identify an online status responder that uses the Online Certificate Status Protocol (OCSP) to check the validity of certificates. For more information about OCSP, see Certificates Settings.
  - SSL Certificate Authority: Certificate used to identify a certificate authority—that is, a service that issues certificates for use as identification over computer networks.
- Issued To: Summarises the following information about the certificate:
  - Common Name: The name of the person or other entity that the certificate identifies.
  - Organisation: The name of the organisation to which the entity belongs (such as the name of a company).
  - Organisational Unit: The name of the organisational unit to which the entity belongs (such as Accounting Department).
  - Serial Number: The certificate's serial number.
- Issued By: Summarises information (similar to that provided under Issued To; see above) about the certificate authority (CA) that issued the certificate.
- Validity: Indicates the period during which the certificate is valid.
- Fingerprints: Lists the certificate's fingerprints. A fingerprint is a unique number produced by applying a mathematical function to the certificate contents. A certificate's fingerprint can be used to verify that the certificate has not been tampered with.

### Details Tab

Click the Details tab at the top of the Certificate Viewer to see more detailed information about the selected certificate. To examine information for any certificate in the Certificate Hierarchy area, select its name, select the field under Certificate Fields that you want to examine, and read the field's value under Field Value:

- Certificate Hierarchy: Displays the certificate chain, with the certificate you originally selected at the bottom. A certificate chain is a hierarchical series of certificates signed by successive certificate authorities (CAs). A CA certificate identifies a certificate authority and is used to sign certificates issued by that authority. A CA certificate can in turn be signed by the CA certificate of a parent CA and so on up to a root CA.
- Certificate Fields: Displays the fields of the certificate selected under Certificate Hierarchy.
- Field Value: Displays the value of the field selected under Certificate Fields.

The Certificate Viewer displays basic ANSI types in human-readable form wherever possible. For fields whose contents the Certificate Manager cannot interpret, it displays the actual values contained in the certificate.

## Choose Security Device

A security device (sometimes called a token) is a hardware or software device that provides cryptographic services such as encryption and decryption and stores certificates and keys. The Choose Security Device window appears when Certificate Manager needs help deciding which security device to use when importing a certificate or performing a cryptographic operation, such as generating keys for a new certificate. This window allows you to select one of two or more security devices that Certificate Manager has detected on your machine.

A smart card is one example of a security device. For example, if a smart card reader connected to your computer has a smart card inserted in it, the name of the smart card will show up in the drop-down menu. In this case, you must choose the name of the smart card from the menu to let Certificate Manager know that you want to use it.

The Certificate Manager also supplies its own default, built-in security device, which can always be used no matter what additional devices are or aren't available.

## Encryption Key Copy

Certificate authorities (CAs) that issue separate signing and encryption email certificates typically make backup copies of your private encryption key during the certificate enrolment process.

The Encryption Key Copy dialogue box allows you to approve the creation of such a backup or cancel the certificate request. A CA that has archived a backup copy of your encryption key has the potential capability of decrypting any messages you receive that were encrypted with your corresponding public key.

You can take these actions from the Encryption Key Copy dialogue box:

- View Certificate: To view the certificate identifying the CA that is requesting the backup copy, click View Certificate.
- OK: If you trust the CA identified by the CA certificate to decrypt encrypted messages that you receive, click OK.

  If you are not sure whether to trust the CA that is requesting the backup copy, talk to your system administrator.

- Cancel: If you don't trust the CA that is requesting the backup copy, don't request a certificate from it. Click Cancel to stop both the backup procedure and the request for a certificate.

After your CA makes a backup copy of the encryption key, you will be able to use that key to access your encrypted mail even if you lose your password or lose your own copy of the key. If no backup copy of your encryption key exists and you lose your password or the key, you will have no way of reading email messages that were encrypted with that key.

## Certificate Backup

When you receive a certificate, make a backup copy of the certificate and its private key, then store the copy in a safe place. For example, you can put the copy on a floppy disc and store it with other valuable items under lock and key. That way, even if you have hard disc or file corruption problems, you can easily restore the certificate.

It can be inconvenient, at best, and in some situations catastrophic to lose your certificate and its associated private key, depending on what you use it for. For example:

- If you lose a certificate that identifies you to important web sites, you will not be able to access those web sites until you obtain a new certificate.
- If you lose a certificate used to encrypt email messages, you will not be able to read any of your encrypted email—including both encrypted messages that you have sent and encrypted messages that you have received. In this case, if you cannot obtain a backup of the private encryption key associated with the certificate, you will never be able to read any of the messages encrypted with that key.

Like any other valuable data, certificates should be backed up to avoid future trouble and expense. Do it now so you don't forget.

## User Identification Request

Some web sites require that you identify yourself with a certificate rather than a name and password, because certificates provide a more reliable form of identification. This method of identifying yourself over the Internet is sometimes called client authentication.

However, Certificate Manager may have more than one certificate on file that can be used for the purposes of identifying yourself to a web site. In this case, Certificate Manager presents the User Identification Request dialogue box, which displays two kinds of information:

This site has requested that you identify yourself with a certificate: This section of the dialogue box lists the following information:

- Host name: The name of the server requesting identification, used as part of its URL. For example, the host name for the Netscape web site is `home.netscape.com`.
- Organisation: The name of the organisation that runs the web site.
- Issued under: The name of the certificate authority (CA) that issued the certificate.

Choose a certificate to present as identification: The certificates you have available for the purposes of identifying yourself to a web site are listed in the drop-down list in this section of the dialogue box. Choose the certificate that seems most likely to be recognised by the web site you want to visit.

To help you decide, the following details of the selected certificate are displayed:

- Issued to: Lists information about the person identified by the certificate (for example, your name and email address) and the certificate's serial number and validity dates.
- Issued by: Summarises information about the CA that issued the certificate, such as its name, location, and state.

## New Certificate Authority

The certificates that the Certificate Manager has on file, whether stored on your computer or on an external security device such as a smart card, include certificates that identify certificate authorities (CAs). To be able to recognise any other certificates it has on file, Certificate Manager must have certificates for the CAs that issued or authorised issuance of those certificates.

When you decide to trust a CA, Certificate Manager downloads that CA's certificate and can then recognise the kinds of certificates you trust that CA to issue.

Before downloading a new CA certificate, Certificate Manager allows you to specify the purposes for which you trust the certificate, if at all. You can select any of the following options:

- Trust this CA to identify web sites: Web site certificates for some web sites, such as those that handle financial transactions, can be extremely important, and inappropriate or false identification can have negative consequences.
- Trust this CA to identify email users: If you intend to send email users confidential information in encrypted form, or if accurate identification of email users is important to you for any other reason, you should consider carefully the CA's procedures for identifying prospective certificate owners and whether they are appropriate for your purposes before selecting this option.
- Trust this CA to identify software developers: Selecting this option means that you trust the CA to issue certificates that identify the origin of Java applets and JavaScript scripts requesting special access to your computer, such as the ability to change files. Since such access privileges can be misused, for example to destroy data stored on your hard disc, be very careful about selecting this option unless you are certain that you trust the CA for this purpose.

Before you decide to trust a new CA, make sure that you know who is operating it. Make sure the CA's policies and procedures are appropriate for the kinds of certificates it issues. For example, if the CA issues certificates identifying web sites you use for financial transactions, make sure you are comfortable with the level of assurance the CA provides.

- View: Click this button to view the CA certificate you are about to download. If you decide you don't want to download this certificate, click Cancel.

## Web Site Certificates

When you attempt to go to a web site that supports the use of SSL for authentication and encryption, you may be faced with an error page. There are two types, one called Secure Connection Failed and one called Untrusted Connection.

In this section:

- Secure Connection Failed Page
- Untrusted Connection Page
- Secure Connection Failed Dialogue
- Server Certificate Expired
- Server Certificate Not Yet Valid
- Domain Name Mismatch

### Secure Connection Failed Page

In the case where you have disabled the SSL protocol (e.g. through SSL/TLS Settings) or the web site that you are accessing is using an older, insecure version of the SSL protocol then you will be presented with a page titled "Secure Connection Failed". That page contains some basic background information (including the Error code that uniquely identifies the type of problem &brandShortName; detected with the web site) and a Try Again button that triggers a page reload.

### Untrusted Connection Page

If SSL itself is enabled then the error page that you will be presented with will be titled "This Connection is Untrusted". There are many different reasons why a connection can appear untrusted. Here are some of the most common ones:

- the certificate of the web site is no longer valid (expired)
- the certificate of the web site is not yet valid
- the certificate of the web site is only valid for another web site (domain name mismatch)
- the certificate of the web site is self-signed (thus the identity of the web site cannot be verified).
- the issuer certificate is not trusted (&brandShortName; cannot verify the identity of the web site because it doesn't recognise the certificate authority (CA) that issued the web site's certificate)

The page displayed in the above cases is meant to help you understand why &brandShortName; was unable to establish a secure connection to the web site. It starts by telling you that the web site's identity could not be verified, then offers you to leave the page by clicking the This sounds bad, take me to my home page instead button. If you are unsure what to do it is recommended that you follow this advice.

If you want to know a little bit more about the actual problem at hand you may expand the corresponding section by clicking the chevron in front of Technical Details. That section also contains the Error code that uniquely identifies the type of problem &brandShortName; detected with the web site.

#### Adding a Security Exception

The I Understand the Risks section of the Untrusted Connection page allows you to tell &brandShortName; to explicitly override the security checks for this web site by adding an exception. If you expand the section by clicking the chevron in front of it you will see an Add Exception button that will take you to a dialogue allowing you to get and view the web site's certificate and optionally add a Security Exception for it (either permanently or just for the current session). Those exceptions can be administered through the Certificate Manager's Servers tab.

### Secure Connection Failed Dialogue

In cases where &brandShortName; cannot determine the actual cause of the problem a dialogue titled "Secure Connection Failed" is shown in addition to the Untrusted Connection page. That dialogue includes a View Certificate button that allows you to examine the web site's certificate more closely.

### Certificate Expired

Like a credit card, a driver's licence, and many other forms of identification, a certificate is valid for a specified period of time. When a certificate expires, the owner of the certificate needs to get a new one.

&brandShortName; warns you when you attempt to visit a web site whose server certificate has expired. The first thing you should do is make sure the time and date displayed by your computer is correct. If your computer's clock is set to a date that is after the expiration date, &brandShortName; treats the web site's certificate as expired.

If your computer's clock is set correctly, you need to make a decision about whether to trust the web site. This decision depends on what you intend to do at the web site and what else you know about it. Most commercial sites will make sure that they replace their certificates before they expire. If you choose to continue you need to add a security exception.

### Certificate Not Yet Valid

Like a credit card, a driver's licence, and many other forms of identification, a certificate is valid for a specified period of time.

&brandShortName; warns you when you attempt to visit a web site whose server certificate's validity period has not yet started. The first thing you should do is make sure the time and date displayed by your own computer is correct. If your computer's clock is set to the wrong date, &brandShortName; may treat the server certificate as not yet valid even if this is not the case.

If your computer's clock is set correctly, you need to make a decision about whether to trust the web site. This decision depends on what you intend to do at the web site and what else you know about it. Most commercial sites will make sure that the validity period for their certificates has begun before beginning to use them. If you choose to continue you need to add a security exception.

### Domain Name Mismatch

A server certificate specifies the name of the server in the form of the web site's domain name. For example, the domain name for the Mozilla web site is `www.mozilla.org`. If the domain name in a server's certificate doesn't match the actual domain name of the web site, it may be a sign that someone is attempting to intercept your communication with the web site.

&brandShortName; warns you when you attempt to visit a web site whose server certificate's domain does not match the domain of the web site you are trying to visit. The decision whether to trust the web site anyway depends on what you intend to do at the site and what else you know about it. Most commercial sites will make sure that the host name for a web site certificate matches the web site's actual host name. If you choose to continue you need to add a security exception.

If you decide to accept the certificate anyway (either for this session or permanently), you should be cautious about what you do on the web site, and you should treat any information you find there as potentially suspect.