Security Warning: The Server you are connected to is using a security certificate that cannot be verified. The Target principal name is incorrect

Question

I'm trying to get my mails using Outlook 2007 and POP3 using SSL but I get this security warning every time I try to receive mails:

The Server you are connected to is using a security certificate that cannot be verified. The Target principal name is incorrect.

When I open the certificate I see this message in the first tab (General):

All the intended purposes of this certificate could not be verified.

Issued by: GeoTrust SSL CA
Issued to: *.justhost.com

which is one of the trusted providers.

Do you think it's a man in the middle attack or a security risk? Or is it just a kind of a certificate error that I can ignore?

Solution

justhost is a hosting service provider and if you/your company host your mail services on their non-dedicated servers, this umbrella wildcard certificate will be used to secure the connection.

There's a limitation in SSL/TLS that the host name the client is connecting to is not revealed to the server until a secure socket has been established. This means the server must blindly supply a default certificate which is the "*.justhost.com" you saw.

Thus if you access the mail server through your company's alias domain, e.g. mail.company.com, a certificate subject mismatch will occur. You could use the following steps to find the correct domain to use:

1. ping your mail server to get its IP address
2. Use nslookup or whois to get the host name of the server. The host name should end with "justhost.com", which is covered by the wildcard certificate.
3. Replace the POP/IMAP server and SMTP server address with the host name in Outlook