Expired Certificates, Cannot connect to customers.

Beginning yesterday, we have encountered a problem where older computers have had their Global Sign Certificates expire.

These Certificates are what enable our software to encrypt your connections.

The Certificate we provide you is ours, and is renewed periodically by us. However, that certificate is also signed by an Intermediary and Root certificate. In our case, this is done by GlobalSign, with certificates that are built in to all operating systems.

On Vista computers and above, the renewal of these certificates is handled by a background process in the OS. On XP, this was handled by Windows Updates. On 2000 though, this was a purely manual procedure, that had to be kept up by the end user.

So on XP computers that have had their Windows Updates disabled, or are otherwise determined to be non-genuine, this update never occurred.

Please follow the procedures outline in the document below.

http://help.logmein.com/SelfServiceKnowledgeRenderer?type=FAQ&id=kA0a0000000shSNCAY

Find more posts tagged with

Comments

EastGen

Thanks ghostinator, that's perfect to get the new cert installed. I was trying to convert their .crt to a .cer and it was failing for me.

As you are aware, the problem is how to get this out to the field.

I have been searching how to get that Reg Key deleted automatically and I'm losing my mind. I know I'm close to solving it, very close, but I am still missing some pieces of the puzzle.

I need to create a CAB file that will delete the key. What I'm tripping on is exactly what needs to be created and in what order...

If you create an XML file with this in it;

<wap-provisioningdoc>

</nocharacteristic>

</characteristic>

</wap-provisioningdoc>

how do you make that into an INF and then into a CAB? Are all those steps necessary?

I found MakeCab, but don't know the proper syntax for that either. I have been to multiple sites that explain what they are, but if you put the _setup.xml file at the root of c:\ do you have to put the whole path into the MakeCab? I didn't see that in the documentation.

So many questions, so few answers!

I also found this for an INF file;

[Version]

Signature=$CHICAGO$

[DefaultInstall]

DelReg=Del.Settings

[Del.Settings]

HKLM,Comm\Security\SystemCertificates\Root\Certificates\2F173F7DE99667AFA57AF80AA2D1B12FAC830338

(chicago is just what was in the sample I found)

But I'm still not sure how to populate the MakeCab thing.

Hoping someone can help put the pieces together.

ghostinator

Windows Mobile handheld users, it's time to rejoice!!

I was so fustrated trying to find a solution for this and the internet and these forums provided no instructions.

I have found the solution for this.

Download the refreshed cert here

https://www.globalsign.com/support/Root-R1.cer

copy it onto the handheld and open it up in file explorer and install it

then use a registry editor program on the handheld and navigate to

HKEY_LOCAL_MACHINE\Comm\Security\SystemCertificates\Root\Certificates\

Delete the folder called
2F173F7DE99667AFA57AF80AA2D1B12FAC830338

This will remove the old expired cert from the cert store and logmeinrescue will only use the new version you've installed which will allow Rescue to connect properly.

How to get this fix to apply to handhelds out in the field i cannot help. My only idea is to do a combination of using mymobiler to get the handheld connected to a PC then teamviewer to access the pc remotely.

I'll gladly accept donations on this through paypal or bitcoin
1KJ3FL189KGapwEPSb3vEuew6WPAM79k84
Neomyaclyk@gmail.com

EastGen

Sean, are there specific instructions on how to do this for a Windows Mobile 6.5 device? I have been struggling for some time now trying to get this to work.

We have over 50 of these devices in the field that we can no longer use Rescue for support.

Thank you in advance.

bryantay

Is there a fix for older OSX computers? I'm experiencing the same issue...

JIMMY1

Manually install applied to Win Sever 2003 for me. Folowed the instructions and it still didn't work so, I did the folowing:

GlobalSign Root R1 had to be installed in the Trusted Root Certification Authorities folder which is not mention on the Global Sign import method.

Now my Logmein connection has been restored.

Sean_K

My original post contains the link to GlobalSign, which defines which certificate has expired., To be honest, I am uncertain as to which certificate you will need, as I do not have a Windows Mobile device to test with.If it is the same as the ones for Desktop OSes, then you need:

GlobalSign Root R1

GlobalSign Organization Validation CA - G2

There is a support link on the GlobalSign site, where they can help you find the right certificate for your device.

Anon42558

Ca explique comment installer un certificat mais je ne vois l? une solution ? mon problème.

Quel certificat devrais-je installer ?

Merci

Sean_K

@Anon42558 wrote:
Bonjour,

Comment faire pour des PDA en Windows Mobile 6 ?

Cordialement.

This article should be able to assist you: http://technet.microsoft.com/en-us/library/cc182301.aspx

Sean_K

@Johnnyljensen wrote:
Hi Sean,

It would have been nice with a little bit of warning on this issue?

I spent the whole day yesterday with you tech support people, who strangely enough, could not find any “apparent” pattern in the fact that we where loosing connections left and right as yesterday progressed .

In retrospect I think they should have know immediately.

Having said that, I can confirm that the Microsoft's fix takes care of XP embedded as well. However the deployment of that fix will turn out to be a very costly affair, which could have bin totally prevented by giving a few weeks notice. We have hundreds of these machines sitting unattended out there in the nationwide landscape. Now we have to send a person to every machine to implement the fix.

Would it be possible, as a courtesy to your paying customers, to skip the certificate check over the next couple a weeks to give us a chance to do the update through the remote interface instead?

Hop you can help and thanks

Johnny Jensen

Unfortunately, there was no way of knowing that this would happen, as these Certificates are, first off, on your own systems and not provided by us, and secondly, were replaced over 2 years ago on any device that had updates enabled/managed.

We only found out about this the day it began, which was the 28th. Since then, our Tech Support team has been spun up on the issue. However, because this involves the Operating System certificates, we cannot do anything but point you in the right direction.

Regarding the disabling of SSL, that is not in any way possible. This would mean you cannot make ANY secure connection with our software, and absolutely everything you did with us would be unencrypted. There is no way, in good conscience, that we could even contemplate that course of action.

Anon42558

Bonjour,

Comment faire pour des PDA en Windows Mobile 6 ?

Cordialement.

Johnnyljensen

Hi Sean,

It would have been nice with a little bit of warning on this issue?

I spent the whole day yesterday with you tech support people, who strangely enough, could not find any “apparent” pattern in the fact that we where loosing connections left and right as yesterday progressed .

In retrospect I think they should have know immediately.

Having said that, I can confirm that the Microsoft's fix takes care of XP embedded as well. However the deployment of that fix will turn out to be a very costly affair, which could have bin totally prevented by giving a few weeks notice. We have hundreds of these machines sitting unattended out there in the nationwide landscape. Now we have to send a person to every machine to implement the fix.

Would it be possible, as a courtesy to your paying customers, to skip the certificate check over the next couple a weeks to give us a chance to do the update through the remote interface instead?

Hop you can help and thanks

Johnny Jensen

Quick Links

Join the conversation!

If you found this discussion useful, why not register/sign-in? It only takes a minute to share your feedback, ask a question, or vote for a new feature!