I'm trying to install NetSuite for Outlook, but during the installation it throws an error because the 'certificate or its site is not trusted' (see attached image for full error).
Any ideas?
Ideally, you need to contact add-in developers. They can guide you how to add a trusted publisher with their certificate.
You can use the command-line tool CertMgr.exe to add a publisher's certificate to the Trusted Publishers store on a client computer. See How to: Add a trusted publisher to a client computer for ClickOnce applications for more information.
Related
I have company provided Samsung S20. I have successfully installed Microsoft's Intune Company Portal App.
Then I was also able to register company portal. However after connecting to company portal, it suppose to download certificate from the company portal. But its not downloading any certificate or i dont see any notifications that it is downloaded.
Once i have the certificate, i will use it to connect to Access Point. But that's next step after i have the certificate.
1>What could be the potential issue for not downloading certificate?
2>Where and how can i view the logs?
3>In Company Portal App, Under settings i see Diagnostic Data-> Copy logs. Which says Copy logs to SD card. Where does it actually copies logs.
4>I am connecting from home. Is there any settings i need to do on router.
Note that, I also have company provided iPhone. and I was able to install and configure everything without any issue.
1>What could be the potential issue for not downloading certificate?
It depends on what you need the certificate for. How are you issuing the certificate to the device? via configuration policy?
2>Where and how can i view the logs?
Plug the device into a computer and allow USB to transfer data and files. Should be under Android\Com.microsoftintunecompanyportal\data
3>In Company Portal App, Under settings i see Diagnostic Data-> Copy logs. Which says Copy logs to SD card. Where does it actually copies logs.
refer to previous answer
4>I am connecting from home. Is there any settings i need to do on router.
Sounds like you're trying to get a trust certificate on the device but I would need to understand more about what you're trying to do. RIght now I'm working on a wifi profile for android devices and am using SCEP certificates to do that. But you're welcome to read this to try to gain a better understanding.
https://learn.microsoft.com/en-us/mem/intune/protect/certificates-configure
While trying to install on other machines I get the following exceptions:
[12:22:33] Shekhar Pandey: Name: OutlookAddIn1
From: https://www.emailcipher.com/outlook/OutlookAddIn1.vsto
Exception Text
System.Security.SecurityException: Customized functionality in this application will not work because the certificate used to sign the deployment manifest for OutlookAddIn1 or its location is not trusted. Contact your administrator for further assistance.
at Microsoft.VisualStudio.Tools.Applications.Deployment.ClickOnceAddInTrustEvaluator.VerifyTrustPromptKeyInternal(ClickOnceTrustPromptKeyValue promptKeyValue, DeploymentSignatureInformation signatureInformation, String productName)
at Microsoft.VisualStudio.Tools.Applications.Deployment.ClickOnceAddInTrustEvaluator.VerifyTrustUsingPromptKey(Uri manifest, DeploymentSignatureInformation signatureInformation, String productName)
at Microsoft.VisualStudio.Tools.Applications.Deployment.ClickOnceAddInDeploymentManager.VerifySecurity(ActivationContext context, Uri manifest, AddInInstallationStatus installState)
at Microsoft.VisualStudio.Tools.Applications.Deployment.ClickOnceAddInDeploymentManager.InstallAddIn()
The Zone of the assembly that failed was: MyComputer
[12:22:48] Shekhar Pandey:
Exception Text
System.Security.SecurityException: Customized functionality in this application will not work because the certificate used to sign the deployment manifest for OutlookAddIn1 or its location is not trusted. Contact your administrator for further assistance.
at Microsoft.VisualStudio.Tools.Applications.Deployment.ClickOnceAddInTrustEvaluator.VerifyTrustPromptKeyInternal(ClickOnceTrustPromptKeyValue promptKeyValue, DeploymentSignatureInformation signatureInformation, String productName)
at Microsoft.VisualStudio.Tools.Applications.Deployment.ClickOnceAddInTrustEvaluator.VerifyTrustUsingPromptKey(Uri manifest, DeploymentSignatureInformation signatureInformation, String productName)
at Microsoft.VisualStudio.Tools.Applications.Deployment.ClickOnceAddInDeploymentManager.VerifySecurity(ActivationContext context, Uri manifest, AddInInstallationStatus installState)
at Microsoft.VisualStudio.Tools.Applications.Deployment.ClickOnceAddInDeploymentManager.InstallAddIn()
The Zone of the assembly that failed was: MyComputer
The URL of the deployment manifest is: https://www.emailcipher.com/outlook/OutlookAddIn1.vsto
How can I enable the deployment of my VSTO Addin?
By looking at your deployment manifest I assume that your certificate with the identity CN=Abc\Dell is not signed with Authenticode and that you use the posted URL to deploy it to the other machines. (But I'm not 100% sure about the latter because you say ftp in the title but https in the posted URL.)
First you have to add your URL on the client machines to the Trusted sites list using the options here. You can check this by opening your .vsto in Internet Explorer and looking at the page properties. Zone should now be Trusted sites and not Internet. If you cannot change the Trusted sites list you can alternatively add your URL to the Local intranet zone as well.
If it still fails with the same error message you have to add your certificate to the Trusted Publishers on the client machine using the commands here. If you don't want to use the command line you can do the same in the GUI using the Certificates snap-in in the MMC or using the method here. If you don't have the permission to add a certificate to the Trusted Publishers because a Group Policy of the client domain is restricting the access then you also have to check the Group Policy settings here.
If your client is using a Windows Server OS you may also have to deactivate the Internet Explorer Enhanced Security Configuration (IEESC) using the settings here. (At least for the duration of the deployment.)
At last you can also check the registry for the settings of the Inclusion Lists using the registry keys here.
I guess that adding your URL to the Trusted sites should be enough to make your VSTO deployment work. If it isn't, adding your certificate to the Trusted Publishers will most likely do the trick.
For our Mango app we have enabled push notifications. But it is unauthorized. In order to have authenticated web service, we need to create and install the required certificate. We are using Tomcat as a web server. Which SSL certificate do we need to create and install and how to do that?
Did you have a look at Setting Up an Authenticated Web Service to Send Push Notifications for Windows Phone in MSDN? It tells you where to put your certificate and what to do next. This article contains some information about how to get a certificate. And the folks at Server Fault are probably the best source to ask about installing it on your server.
I am currently working on a project that has the following components (all .NET 2.0)
Client Application
Web Service Invocation API
Web Service
In summary the Client Application creates and instance of the API and this calls the Web Service. Nice and simple and this all works exactly as I want it to.
The next stage of the project was to secure the Web Service with SSL. So I have created a "Self Signed CA" and from this signed a server certificate for IIS. Again, nice and simple and this all works exactly as I want it to.
The next stage of the project is to secure the Web Service by requiring the invoker to supply a client certificate. So I have created a client certificate (via the Self Signed CA). I am then adding this to the Web Service invocation call in the API:
WSBridge.Processor processor = new WSBridge.Processor();
processor.Url = this.endpoint;
processor.ClientCertificates.AddRange(this.clientCertificates);
processor.Timeout = (int)Settings.Default["DefaultTimeout"];
In debug I can see that this.clientCertificates contains the certificate I created. So in theory it is being presented to the web server.
However, when I attempt to call the Web Service I get the following exception in the API:
The request failed with HTTP status 403: Forbidden.
Fairly self explantory, but I have no idea what is causing the problem.
Other relevant information:
In my dev environment Client, API & Web Service are all running on the same machine
If I attempt to access the Web Service Description in IIS I get the following error (I am not prompted to choose a client certificate):
HTTP Error 403.7 - Forbidden
The page you are attempting to access requires your browser to have a Secure Sockets Layer (SSL) client certificate that the Web server recognizes.
The client certificate is loaded into the Personal store for the current user, the CA root is in trusted root for the local machine and current user.
If I switch off "Require SSL" and put "Client Certificates" on accept in IIS I can make my request. However when I look at HttpContext.Current.Request.ClientCertificate.Count in the Web Service this comes back as 0.
I need to be able to run my development with client certificates as portions of the service code use the CN of the client certificate to perform various actions. I could hack it in but it would be nice to be able to do a real end to end.
All the certificates mention here were generated using OpenSSL. I am developing on Windows 7 so I do not have the facility to install Microsoft CA
So, does anybody have any ideas as to the cause of this problem?
As an aside (not worth creating a new question for this) - for some reason when I enable SSL for the Web Service Visual Studio is no longer able to debug the service.
EDIT : Some more information
The client certificate has an intended purpose of <All>
Although I am working on localhost the server certificate for the web server was issued to devserver.xyz.com so I have changed my hosts file to point that to localhost. As such I can now browse (with client certs switched off in IIS) to my service descriptor page without seeing any SSL certificate warnings.
Well I have solved the problem, in summary this was due to the format of the client certificate this should have been PKCS12.
More Detail
Although the MMC Certificate plugin was showing the client certificate in the personal store for the current userm I noticed that when viewing the same store via Internet Explorer (Tools -> Internet Options -> Content -> Certificates) the certificate was not present.
After a little Googling it seems that IE will only accepts PKCS12 format for client certificates, so I convert the certificate with the following OpenSSL command:
openssl pkcs12 -export -in client_alpha.cer -inkey client_alpha.key -out client_alpha.p12
I then imported the p12 file into IE which allowed me to browse to the Web Service description page with full client/server certificated TLS.
Once I had made this change, I then retried by client application and this now works aswell. This is due to the fact that IIS, like IE, will only accept client certificates in PKCS12 format.
When i tried to call .Net web service http://....using windows 7 API's
Its working fine. But if i used with same web service https://... i got
security error like There is a problem with this website's security certificate.
Help me out for this query...
You're probably using a test certificate or other certificate not supported by the phone.
If that's the case then your question is a duplicate of Making a WP7 HttWebRequest POST with an untrusted cert?
The solution to your problem is that you can't and must get a certificate from a trusted root certificate authority.
The site you're accessing needs to have a valid certificate from an issuer recognised by the platform. The latest list of these issuers I've seen is here.
push notifications from authenticated services
Note Geotrust will give you a 30 day trial certificate which is handy for testing.
Update: New documentaiton of trusted certificate issuers.