certificate error with school website

[mollykins]

This has always been like it since i started the school but never bothered to ask about it.

Why is it that according to my computer, there is a certificate error when accessing my school emails? it says that it isn't a safe website and recommends that I don't proceed to log on. It's a perfectly safe thing that i've usued for over three years now, which i've never had problems with and why would the school emails part of the website (not the general website) be the only part that has the message come up anyway?

[mike11111]

Have you asked the school IT people?

[ChuckFickens]

At a guess...

Because the main website is served as a normal http (i.e. non secure) web site whereas the mail is served as a https (i.e. secure) website and the school haven't been bothered to buy a valid security certificate for their webserver.

[mollykins]

Wouldn't surprise me chuck if that was the reason.

[ChuckFickens]

also a proper security certificate costs about £100 a year.

[mollykins]

And because the only people that would go on it are from the school, the teckies know that the pupils will know it's safe, seeing as we use it at school safely.

But how come it doesn't come up as that when we go on the emails at school, is it something to do with at school, you just click on the inbox icon and there it is, but at home you have to go through the school website and log on. Although once you've logged on at home the bar at the top where the web address is, is red, or is it to do with the server being in the same place IDK i'm not a teckie!

[Buenchico]

When you go into the email section, does the start of the web address change from 'http' to https'? If so you're being taken to a secure page and your browser will look for a 'secure server certificate' (also known as an SSL certificate, because it uses 'secure socket layer' technology) to prove that it's really the site which it's claiming to be.

SSL certificates are only valid for a certain period of time, and they're far from cheap. (A three-year certificate, from Verisign, costs £525 + VAT). With cut-backs in education expenditure it's not surprising that your school hasn't renewed their SSL certificate.

Chris

[ChuckFickens]

You are being ripped off with security certificates if you are paying that much Chris :)

Molly, internal access is often through different channels than external and will often not be using secure http (https) because it's simply not needed while accessing sites from a LAN rather than a WAN.

[mollykins]

I don't think they had one in the first place seeing as it's always happened on my home computer.

The schools general website starts with http. but the email page with the warning not to proceed is owa. then it stays as owa but the whole tab with the web address in goes red!

[ChuckFickens]

LOL....

so they use Microsoft exchange then....

It's not your problem to worry about, molly.... if they want somebody to come in and sort out their security certificates and show them how to remove the error without having to buy a certificate then I will do it for a consultant fee, but otherwise just put up with it. (or tell the IT department it's possible and they should work it out themselves)

[mike11111]

Not sure I shouldn't report you for advertising there, Chuck -:)

[ChuckFickens]

But as a hint.....

Exchange can self generate a valid security certificate which should remove the problem..... But it needs to be done every year and it sounds like the school isn't bothering (it's only about 3 lines that needs to be entered into the Exchange management shell (not console)) and as long as some thought was put into the external name of the server and the internal name of it the self generated certificate works fine.

Bottom line is.... it's not your problem, and if they are happy with it like it is then they won't change it.