Communicator Help: Using AOL<sup><font size=-2>®</font></sup> Communicator Identity Manager

Contents | Index | Tutorial Movies

Using AOL Communicator Identity Manager

Managing Certificates

You can use Identity Manager to manage the certificates you have available. Certificates may be stored on your computer's hard disk or on smart cards or other security devices attached to your computer.

To open Identity Manager, click Start, then Programs, then AOL Communicator, then Tools, and choose AOL Communicator Identity Manager.

Personal Certificates
Export Certificate
Import Certificate

Certification Authorities
Other People's Certificates
Web Site Certificates
Miscellaneous Certificates

Certificate Selection Settings
Server Certificate Problem
User Identification Request

Personal Certificates

Identity Manager has several tabs. The first is labeled Personal and displays the certificates on file that identify you. Your personal certificates are listed under the names of the organizations that issued them.

- If you can't see certificate names under an organization's name, double-click the name.
- To select a certificate, click its name.
- To select more than one certificate, hold down the Control key and click their names.

To perform the following actions, select one or more certificates and click the corresponding buttons

- Properties: Display detailed information about the selected certificates.
  The Properties button is available only if a single certificate is selected. You can't open Properties for multiple certificates at the same time.
- Delete: Delete the selected certificates.
  Before deleting a personal certificate that has expired, make sure you won't need it again for reading old e-mail messages that you may have encrypted with the corresponding private key.
- Export: Initiate the process of saving the selected certificates. A window appears that allows you to choose a password to protect the exported file. You can then save it in a directory of your choice.
  Note: Certificates on smart cards cannot be exported. You can only export certificates that are stored on the built-in Software Security Device.

These actions do not require a certificate to be selected:

- Import: Import a file containing one or more certificates that were previously exported.
  When you click Import, Identity Manager first asks you to locate the file that contains the backup. The names of certificate backup files typically end in `.p12`; for example, `MyCert.p12`. After you select the file to be imported, Identity Manager asks you to enter the password that you set when you exported the certificate.
- Synchronize. Synchronize AOL Communicator certificates with the certificates stored by Windows for use with Internet Explorer.

Related Topic:

Synchronize Windows Certificates with AOL Communicator

<< back to top

Export Certificate

When you click Export in the Personal Certificates tab of the Identity Manager, you will be asked to create a private key password.

This password protects the file into which you are exporting personal certificates. Identity Manager requests this password when you attempt to import certificates that have previously been exported.

- Enter new password: Type the new password for your export file into this field. Check the password quality meter as you type.
- Confirm new password: Type your backup password again. If you don't type it the second time exactly as you did the first time, you'll see an error message when you click OK. If this happens, try typing the new password again.

If someone obtains the file containing a certificate that you have backed up and successfully imports the certificate, that person can send messages or access web sites while pretending to be you. This can be a problem, for example, if you digitally sign important e-mail messages or manage your bank or investment accounts over the Internet.

Therefore, it's important to select a password that is difficult to guess. The password quality meter gives you a rough idea of the quality of your password as you type it based on factors such as length and the use of uppercase letters, lowercase letters, numbers, and symbols. It does not guarantee that your password cannot be guessed, however.

For more information, see Using the Password Quality Meter.

It's also important to record the password in a safe place—and not anywhere that's easily accessible to someone else. If you forget this password, you can't import the exported certificates.

Import Certificate

When you click Import in the Personal Certificates tab of the Identity Manager, you will be asked to enter the private key password that was used to encrypt the certificate backup file you are attempting to import.

You must enter the same password that was used to protect the backup file when it was created. If you didn't create the backup file yourself, check with your system administrator.

You can't import the certificates in the backup file without entering this password.

The password quality meter gives you a rough idea of the relative quality of your password as you type it based on factors such as length and the use of uppercase letters, lowercase letters, numbers, and symbols.

Related topic:

Using the Password Quality Meter

<< back to top

Certification Authorities

The Certification Authorities tab in Identity Manager displays the certificates you have on file that identify certificate authorities (CAs). (If you're not sure how to open Identity Manager, see Managing Certificates.)

CA certificates are grouped under the names of the organizations that issued them:

- If you can't see CA certificate names under an organization's name, double-click the name.
- To select a CA certificate, click its name.
- To select more than one CA certificate, hold down the Control key and click their names.

To perform the following actions, select one or more certificates and click the corresponding buttons

- Properties: Display and edit detailed information about the selected certificates.
  The Properties button is available only if a single certificate is selected.
  Click this button to designate a CA certificate as one that you trust or don't trust for identification purposes.
  To ensure that an entire certificate chain of CAs are all trusted, you need to edit the root CA certificate only.
  The root and intermediate CAs all appear under the same organization. The root certificate is the one that lists itself as the issuer.
- Delete: Delete the selected certificates.
  Before deleting a CA certificate, make sure that you won't need it again to validate certificates issued by that CA. If you delete the only valid certificate you have for a CA, Identity Manager will no longer trust any certificates issued by that CA.
- Export: Initiate the process of saving the selected certificates. You can save the exported file in a directory of your choice.
  Note: Certificates on smart cards cannot be exported. You can only export certificates that are stored on the built-in Software Security Device.

This action does not require a certificate to be selected:

- Import: Import a file containing a CA certificate or a chain of CA certificates.
  After you click Import, you can either provide an URL or import the certificate from a file.
  When you click Import, Identity Manager first asks you to locate the file that contains the backup. The names of CA certificate backup files typically end in `.p7b`; for example, `CACertBackup.p7b`.

<< back to top

Other People's Certificates

The Other People tab in Identity Manager displays e-mail certificates you have on file that identify other people. (If you're not sure how to open Identity Manager, see Managing Certificates.)

When people send you digitally signed e-mail messages, Identity Manager imports their certificates automatically. You can use these certificates to send encrypted messages to those people.

Other people's certificates are listed under the names of the organizations that issued them:

- If you can't see certificate names under an organization's name, double-click the name.
- To select a certificate, click its name.
- To select more than one certificate, hold down the Control key and click their names.

To perform the following actions, select one or more certificates and click the corresponding buttons

- Properties: Display and edit detailed information about the selected certificates. Click this button to designate another person's certificate as one that you trust or don't trust for identification purposes.
  The Properties button is available only if a single certificate is selected.
- Delete: Delete the selected certificates.
  Before deleting someone else's certificate, make sure you won't need it again to send encrypted e-mail to that person.
- Export: Initiate the process of saving the selected certificates. You can save the exported certificate in a directory of your choice.
  Note: Certificates on smart cards cannot be exported. You can only export certificates that are stored on the built-in Software Security Device.

This action does not require a certificate to be selected:

- Import: Import a file containing one or more certificates identifying other people.
  After you click Import, you can either provide an URL or import the certificate from a file.
  When you click Import, Identity Manager first asks you to locate the file that contains the backup. The names of backup files for other people's typically end in `.p7b`; for example, `CertBackup.p7b`.

<< back to top

Web Site Certificates

The Websites tab in Identity Manager displays e-mail certificates you have on file that identify web sites. (If you're not sure how to open Identity Manager, see Managing Certificates.)

Web site certificates are grouped under the names of the organizations that issued them:

- If you can't see certificate names under an organization's name, double-click the name.
- To select a certificate, click its name.
- To select more than one certificate, hold down the Control key and click their names.

To perform the following actions, select one or more certificates and click one of the following buttons:

- Properties: Display and edit detailed information about the selected certificates. Click this button to designate a web site certificate as one that you trust or don't trust for identification purposes.
  The Properties button is available only if a single certificate is selected.
- Delete: Delete the selected certificates.
  Before deleting a web site certificate from the Websites tab in the Certificate Manager, make sure that you won't need it again for the purposes of identifying a web site and setting up an encrypted connection.
- Export: Initiate the process of saving the selected certificates. A window appears that allows you to choose a password to protect the exported file. You can then save it in a directory of your choice.
  Note: Certificates on smart cards cannot be exported. You can only export certificates that are stored on the built-in Software Security Device.

This action does not require a certificate to be selected:

- Import: Import a file containing one or more certificates that were previously exported.
  After you click Import, you can either provide an URL or import the certificate from a file.
  When you click Import, Identity Manager first asks you to locate the file that contains the backup. The names of backup files for web site certificates typically end in `.p7b`; for example, `WebSiteCertBackup.p7b`.

<< back to top

Miscellaneous Certificates

The Miscellaneous tab in Identity Manager displays certificates that don't fit in any of the other available categories. (If you're not sure how to open Identity Manager, see Managing Certificates.)

In general, certificates stored in this tab are either incorrectly configured or configured for special purposes. Consult your system administrator or certificate issuer for more information.

<< back to top

Certificate Selection Settings

Some mail servers require you to identify yourself with a certificate. The Certificate Settings preference panel allows you to determine how AOL Communicator identifies the certificate to present among the certificates you may have on file.

If you are not already viewing Certificate Settings, open the Edit menu in Identity Manager and choose Security Preferences.

You can choose one of these options:

- Choose automatically from the available certificates: Click this option if you want AOL Communicator to select a certificate without asking you. This is the default setting.
- Prompt me to choose a certificate every time: Click this option if you want AOL Communicator to ask you which certificate to use each time a server requests one.

<< back to top

Server Certificate Problem

If there is a problem with the certificate used to identify one of your mail servers, you'll see a Security Error window that describes the problem.

For example, you might see an error message if you attempt to send a message to a server that has a certificate problem.

When you're alerted of a problem with a server certificate, you have three options:

- To view the certificate that has the problem, click View Certificate.
  This button opens the Certificate Properties window while the Security Error window remains open. You can view the certificate's properties before making a decision about whether to continue with the connection.
- To connect to the server anyway, click OK.
- To cancel whatever operation you were attempting to perform, click Cancel.

Some problems related to server certificates are potentially serious. Unless you are familiar with the problem listed and know exactly how to handle it, you should consult your ISP or system administrator before attempting to connect to the server.

Here's some further information about problems that this window may describe:

Domain name mismatch: The domain name in the server's certificate doesn't match the server's actual domain name. This may be a sign that someone is attempting to intercept your communication with the web site.

Most commercial server administrators make sure that the host name for a web site certificate matches the web site's actual host name. In some cases, the server administrator may be aware of the problem but has decided not to fix it.

The certificate was issued by an unknown certificate authority: AOL Communicator doesn't recognize the certificate authority (CA) that issued the server's certificate. The most likely explanation is that the certificate identifying the CA is not included in Identity Manager's list of CA certificates.

If you are sure that you've entered your server information correctly, you can choose to trust the certificate itself even if the CA certificate isn't available. For details, see the Trust Tab section of Certificate Properties.

The certificate was issued by a certificate authority that you do not trust. AOL Communicator has a copy of the certificate identifying the certificate authority (CA) that issued the server's certificate. However, there is a problem with the trust settings for the CA certificate.

If you are sure that the server certificate is valid, you can choose to trust the server certificate itself and/or the CA that issued the certificate. For details, see the Trust Tab section of Certificate Properties.

The security certificate is not trusted by you: There is a problem with the trust settings for your copy of the server certificate.

If you are sure that the certificate is valid, you can choose to trust the server certificate itself. For details, see the Trust Tab section of Certificate Properties.

The CA certificate that issued the site's certificate has expired or is not yet valid; OR the server certificate has expired or is not yet valid: Make sure the time and date displayed by your computer is correct. If your computer's clock is set to a date that is before or after the validity period for a certificate, AOL Communicator treats the certificate as expired.

If your computer's clock is set correctly, you need to make a decision about whether to trust the server. Most commercial sites will make sure that they replace their certificates before they expire.

There should be a more recent CRL available: Certificate Revocation Lists (CRLs) identify certificates that the issuer has declared invalid.

For more information. about CRLs, see Controlling Certificate Validation.

The certificate has been revoked: The issuer of the server certificate has declared it invalid.

<< back to top

User Identification Request

Some servers require that you identify yourself with a certificate rather than a name and password. A certificate is the digital equivalent of an ID card.

However, AOL Communicator may have more than one certificate on file that can be used to identify you to the server. In this case, you'll see the User Identification Request window, which displays the following information:

This site has requested that you identify yourself with a certificate:

- The name of the server requesting identification, used as part of its URL. For example, the host name for the Netscape web site is home.netscape.com.
- Organization: The name of the organization that runs the server.
- Issued under: The name of the certificate authority (CA) that issued the certificate.

Choose a certificate to present as identification: The drop-down list in this section includes all the certificates you have available that can identify you to a server.

Details of selected certificate: To help you decide which certificate to use, you can check this information about the selected certificate:

Issued to: Lists information about the person identified by the certificate (for example, your name and e-mail address) and the certificate's serial number and validity dates.

Issued by: Summarizes information about the CA that issued the certificate, such as its name, location, and state.

<< back to top

The sections in this document that discuss security, encryption, and privacy are provided by AOL for your information only. They may help you take certain steps to protect the privacy and security of your personal information on the Internet. This document does not, however, address all online privacy and security issues, nor does it represent a recommendation by AOL about what constitutes adequate privacy and security protection on the Internet.

© 2002-2003 America Online, Inc. All rights reserved. Trademark Information

Last Updated September 16, 2003