On Wed, 2005-08-24 at 11:00 -0600, kevin.kempter@xxxxxxxxxxxxxxxxx wrote: > On Wednesday 24 August 2005 10:50, Craig White wrote: > > On Wed, 2005-08-24 at 10:47 -0600, kevin.kempter@xxxxxxxxxxxxxxxxx > > > > wrote: > > > Hi List: > > > > > > I continually see this message from Kmail: > > > > > > The IP address of the host pop3.dataintellect.com does not match the one > > > the certificate was issued to > > > > > > I choose accept and forever but It keeps coming back. How can I get rid > > > of this message? > > > > ---- > > I don't think I would ever want to not get this particular alert. If the > > IP doesn't match the certificate, why bother having a certificate at > > all? > > > > Craig > > So what exactly is this telling me? ---- Assuming that dataintellect.com management procured a certificate from one of the 'trusted' Certificate Authorities and it certifies that pop3.dataintellect.com can only have this IP address that: - The ip address changed and the error is innocent because dataintellect.com is either too cheap or too dumb to update certificate or - The machine you think is pop3.dataintellect.com isn't that computer at all and you have no reason to trust the machine called pop3.dataintellect.com at all. Assuming that dataintellect.com management is their own certificate authority and generated their own certificate, they are truly inept as they should figure out how to revoke the certificate and create a new, properly configured certificate. Certificates are about trust. If you can't trust the certificate to at least match the computer you are talking to, you really have no trust at all and presuming that you are using this certificate to create an encryption trust between your computer and that computer, you can't trust that computer to be the computer that it says it is. Craig
