Skip to content

Instantly share code, notes, and snippets.

@Aldaviva

Aldaviva/comodo.md

Last active August 5, 2017 12:33
Show Gist options
  • Save Aldaviva/e3a994b818bc01d526a616dcd55e4854 to your computer and use it in GitHub Desktop.
Save Aldaviva/e3a994b818bc01d526a616dcd55e4854 to your computer and use it in GitHub Desktop.
Download ZIP
Fix Comodo intermediate certificate in Windows certificate store
Raw
comodo.md

There is a bad interaction between the Comodo intermediate CA certificates that are distributed in the Windows Trusted Root CA list and generated X.509 certificates from Comodo. This fix has to be applied repeatedly, whenever Windows autoupdates its Trusted Root CA list.

See CertPathValidatorException with Windows server and Android client for the symptoms and causes.

Disable the invalid intermediate certificate

manually

  1. start > run > mmc
  2. file > add/remove snap in
  3. certificates
  4. computer account
  5. local computer
  6. trusted root certification authorities > certificates
  7. cut "COMODO RSA Certification Authority" (but leave "COMODO Certification Authority" and "COMODO ECC Certification Authority" alone)
  8. paste into personal > certificates, which effectively disables it

If you don't want to keep a backup copy in Personal Certificates, you can instead just delete the COMODO RSA Certification Authority.

automatically

You can add a Scheduled Task that runs certmgr.exe.

certmgr.exe -del -v -c -sha1 afe5d244a8d1194230ff479fe2f897bbcd7a8cb4 -s -r localMachine Root

Force MDaemon to recalculate the trust path

  1. open mdaemon
  2. security > security settings
  3. ssl & tls > mdaemon
  4. choose the wrong cert, hit apply
  5. choose the right cert, hit apply

If you don't have any other certs, try clicking Restart Servers.

Verify

k-9 mail should not throw any more certificate errors

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment