Question

I have a self-signed certificate installed that worked perfectly with FogBugz 6 but no longer works? What gives? My FogBugz can't check email anymore because of this.

Answer 1

Problem: Names do not match

If you get this error, it means the server host name and the host name on the cert are different:

The host name in the certificate is invalid or does not match

FogBugz 7 uses .NET now so the certificate handling is more strict. Your certificate must be built so the name on the cert matches the name you are using for FogBugz.

Windows FogBugz Server

You can use Microsoft's SelfSSL.exe IIS6 Resource Kit tool to rebuild your certificate so the name matches.

Unix FogBugz Server

Rebuilding the certificate is left as an exercise to the reader.

Problem: Cert is self-signed

You must add the cert to the trusted list.

Windows FogBugz Server

One of our developers (David) came up with these steps for getting a self-signed cert to work in FogBugz 7 for Windows (NB: You may need to install the certificate logged in as the same user that runs FogBugz).

1. Get the certificate file. You can probably do this with openssl, but I used IE7:

   1. Hit the URL & port
   2. Click the SSL icon and select "View Certificate"
   3. Select "Details" > "Copy to File"
   4. Select .P7B format (Cryptographic Message Syntax Standard) and select "Include all certificates in the certification path if possible"
   5. Save it somewhere

2. Import the certificate file.

   1. Run Start > Run > "MMC"
   2. File > Add/Remove Snap-in
   3. Add... > Certificates
   4. Select Computer Account, then Local Computer
   5. Expand Certificates, then right-click "Trusted Root Certification Authorities" > All Tasks > Import
   6. Select your certificate file
   7. Verify that it is in the list under "Trusted Root Certfication Authorities", and that the "Advanced..." tab indicates that it is valid for "Secure Email"

Unix FogBugz Server

For FogBugz 7 on Unix / Mac, you can import the certificate into the trusted root with the mono certmgr command on the FogBugz server. If you had mono installed before you installed FogBugz 7, specifying the full path (as below) will make sure to run the copy of certmgr that FogBugz installed. This command needs to be run as root since that is the user who owns the runtime/lib directory:

/opt/fogbugz/runtime/bin/certmgr -ssl pop3s://mailserver:995

Replace mailserver with the address of your mailserver and certmgr will download the certificate for you.

Answer 2

FogBugz 7 uses .NET now so the certificate handling is more strict. Your certificate should be built so the name on the cert matches the name you are using for FogBugz.

If you get this error:

The host name in the certificate is invalid or does not match

You can use Microsoft's SelfSSL.exe IIS6 Resource Kit tool to rebuild your certificate so the name matches.