User manual KERIO TECHNOLOGIES ADMINISTRATION CONSOLE HELP

[. . . ] Kerio Administration Console Help Kerio Technologies s. r. o. © Kerio Technologies s. r. o. This brief guidelines refer to Kerio Administration Console in version 2. 4. 6. All additional modifications and updates reserved. Contents 1 2 What is Kerio Administration Console?Installation, File Location and Startup . [. . . ] If fingerprints do not match with each other, the certificate is fake. HINT: Certificate fingerprint can be saved to the clipboard and pasted to a file, email message, etc. If the IP address, application type and certificate's fingerprint are correct, it is possible to connect securely to the server. Otherwise, use the Close button to deny the connection and try to find what caused the problems. If the address and the server certificate do not change upon the next connection, Administration Console will consider the server as trustworthy and the identity verification dialog is not opened since then. How to detect the server certificate's fingerprint?A special, automatically generated SSL certificate is used to secure traffic between the server application and the Administration Console. This certificate is created upon the first startup of the server application after the installation or/and whenever the certificate cannot be found (it might have been removed, damaged, etc. ). The certificate is saved in file server. crt under the dbSSL subdirectory of the installation directory of the server application (the exact path depends on application type and on the operating system). The method used to detect the certificate's fingerprint depends on the operating system of the server: Windows By default, the server's certificate is stored under C:\Program Files\Kerio\WinRoute Firewall\dbSSL or C:\Program Files\Kerio\MailServer\dbSSL A dialog with certificate information is displayed upon opening of the certificate file (by double-clicking or by pressing the Enter key). 14 3. 3 Checking the server's identity Figure 3. 7 Viewing the server certificate's fingerprint on Windows On the Details tab, look at the Thumbprint field. This field includes the certificate's fingerprint which can be saved to the clipboard and pasted to a file, email message, etc. Linux and Mac OS X (Kerio Connect only) By default, the server's certificate is stored under /opt/kerio/mailserver/dbSSL (Linux), or /usr/local/kerio/mailserver/dbSSL (Mac OS X). To detect the certificate's fingerprint, use the openssl application (the OpenSSL package is required to be installed on the system). In the console (terminal), open the directory which includes the server. crt file and enter the following command: openssl x509 -in server. crt -noout -text -fingerprint -sha1 This command displays certificate information, providing the certificate's fingerprint on the last line: SHA1 Fingerprint=F4:D1:F4:49:57:99:81:10:D6:41:8F:0E:2E:A5: 77:42:80:E9:70:D0 2 A proprietary name of the certificate's fingerprint. 15 Program Control Repeated connection to the same server Unless the certificate's fingerprint or IP address of the server is changed, Administration Console verifies only through username and password during future connections. The verification of the certificate and the IP address of the server is hidden and the user cannot see it. If the certificate's fingerprint has been changed, a warning is displayed -- see figure 3. 8. Figure 3. 8 Verification of the server's identity -- detection of the certificate change Such a situation may occur when the server is reinstalled or when its certificate has been, by any reason, damaged or removed. In such a case, the server application has created a new certificate the fingerprint of which does not match with the fingerprint saved in the Administration Console. When we learn of such a change, verify the certificate's fingerprint applying the same mthod as for the forst connection (see above). If the new (accepted) fingerprint of the certificate matches with the server's certificate, connection can be allowed. In this case, the saved certificate's fingerprint is overwritten by the new fingerprint and no warning will be displayed upon future connections. If the certificate on the server has not been changed, the situation might point at an attack (fake certificate). In such a case, use the Close button to deny the connection and try to find what caused the problems. Note: When the server application is being upgraded, the original certificate is kept. [. . . ] However, corresponding login data may be imported and new bookmarks can be created out of the old ones. To import and convert old bookmarks, use the Tools / Import old bookmarks option in the main menu of the Administration Console. First, Administration Console searches a file which includes old bookmarks (_admin. bkm) in the home directory of the current user. If the file is found, the Administration Console checks whether it is encrypted and password-protected. [. . . ]