My wife is having trouble getting into her AOL mail box. It says security certificate is revoked.?

Question

It says there is a problem but they wont tell you exactly what it is or how to fix it.We tried windows help but they said it was not their problem, it was AOL e-mails problem. We went onto AOLs'help site and they would not help us because it is a free e-mail site. They recommended that she close this webpage and not to continue to this website. It is only the AOL email that is locked not the AOL web site. How can we retrieve her e-mail, there were things about Christmas orders we would like to have back.

Answer 1

Your wife has one hell of a serious problem with AOL.

Quoted from Microsoft TechNet.

For certificate status to be determined, a Public Key Infrastructure (PKI), certificate revocation information must be made available to individuals, computers, and applications attempting to verify the validity of certificates. Traditionally a PKI uses a distributed method of verification so that the clients do not have to contact the Certification Authority (CA) directly to validate the credentials presented. Without checking certificates for revocation, the possibility exists that a security principal will accept credentials that have been revoked by a CA administrator.

Certificates are issued with a planned lifetime and explicit expiration date. A certificate may be issued for one minute, thirty years or even more. Once issued, a certificate becomes valid once its validity time has been reached, and it is considered valid until its expiration date. However, various circumstances may cause a certificate to become invalid prior to the expiration of the validity period. Such circumstances include change of name, change of association between subject and CA (for example, when an employee terminates employment with an organization), and compromise or suspected compromise of the corresponding private key. Under such circumstances, the CA needs to revoke the certificate.

There are several mechanisms to represent revocation information; RFC 2459 defines one such method. This method involves each CA periodically issuing a signed data structure called a certificate revocation list (CRL). A CRL is a time stamped list identifying revoked certificates, which is signed by a CA and made freely available in a public repository. Each revoked certificate is identified in a CRL by its certificate serial number. When a certificate aware system uses a certificate (for example, for verifying a remote user's digital signature), that system should not only check the certificate signature and time validity, but it should also acquire a suitably recent certificate status to ensure the certificate being presented is not revoked. In the case of CRLs, Microsoft defines as suitably recent a CRL that is not past the next update time of the CRL. A CA issues a new CRL on either a configured regular periodic basis (for example, hourly, daily, or weekly) or on an event basis; for example, if an important certificate is deemed compromised, the CA may issue a new CRL to expedite notification of that fact.

There are several types of CRLs: full CRLs (also known as base CRLs), delta CRLs, and CRL Distribution Points (CDPs). Full CRLs contain the status of all certificates. Delta CRLs contain only the status of all certificates that have changed status between the issuance the last Base CRL. CRL Distribution Points are used to anchor a well-known location for Base, Delta, and even partitioned CRLs..

An entry is added to the CRL as part of the next update following notification of revocation. An entry may be removed from the CRL after appearing on one regularly scheduled CRL issued beyond the revoked certificate's validity period

Note: The ability to remove an entry from the CRL is only available if the certificate was revoked with the reason "Certificate was revoked with the reason "Certificate Hold."

Think of the above like when you go to use your credit card on line. You only want to use a webpage that shows "VeriSign", security certificate issued that the webpage uses high encryption. These are the only webpages you want to use your credit on, where you see this sign.

Security certificate are also related to the provider of your email account.

Sounds like you are going to have to deal with AOL. I don't use them. I use a very secure email account out of Perth, Australia. http://www.fastmail.fm (Has security technologies not found in other email service).

Minddoctor, France

Answer 2

2

Answer 3

Google shows dozens of people with similar problems. Hopefully one of the forums shows a solution.

http://www.google.com/search?hl=en&q=aol+security+certificate