Eudora won't connect to pangea; says SSL Negotiation Failed: Certificate Error.... How do I fix this?

Last revision July 10, 2006

SSL is an encryption method used for secure web servers and for some types of secure email connections. Specifically, one of the recommended ways to configure the Eudora email client to work with pangea is to use the POP protocol with SSL encryption.

When your computer connects to a server like pangea with SSL, pangea must prove it's identity by supplying a special digital signature called an "SSL certificate". This is to prevent hackers from "hijacking" your network connection.

Certain versions of the Eudora email client program for Windows PCs are especially untrusting of SSL connections. The first time you connect to a new POP server with SSL, such as pangea, these versions of Eudora may refuse the connection because they do not recognize the SSL certificate. The error message Eudora generates looks like:

SSL Negotiation Failed: Certificate Error: Cert Chain not trusted. Try adding this certificate to your certificate database for SSL to succeed...

Pangea's SSL certificate must be renewed approximately every two years. The renewal certificate differs slightly from the original, and may trigger the same error message shown above, even though Eudora has been working okay for a long time. Pangea's SSL certificate is scheduled for renewal on June 29, 2006.

How to fix the problem

Eudora itself tells you how to fix this problem: add pangea's SSL certificate to Eudora's certificate database.

For some 6.2.x versions, Eudora will immediately prompt whether you want to trust pangea's SSL certificate in the future. Just click on the Yes button and Eudora will add pangea's SSL certificate to its trusted database.

For earlier Eudora versions, the process is more complicated. Follow these instructions to do that. Your version may have slight differences from these screenshots.

From the main screen in Eudora, select the Tools->Options menu item to bring up the Options window, and then click on the Checking Mail item, to get a window that looks like:

Click on the Last SSL Info button on the Checking Mail window (circled in red on screen shot above). That will open the Eudora SSL Connection Information Manager window, which looks like:

This window will show that your connection attempt to pangea failed with a certificate error. Click on the Certificate Information Manager button (circled in red on screen shot above). That will open the Certificate Information Manager window, which looks like:

The pangea certificate that Eudora did not like will be highlighted, as shown in the screen shot above. It should say "GTE CyberTrust Solutions", as shown on this screen shot, because that is the company that is issuing the certificate to pangea. On this window, click on the Add to Trusted button (circled in red on screen shot above). Eudora will now import the certificate into its trusted database and you will be able to connect to pangea without error.

To close up, click the Done button on the Certificate Information Manager window, and the OK buttons on the Eudora SSL Connection Information Manager and Checking Mail windows.

You can also consider switching from SSL encryption to kerberos encryption, which has other advantages and disadvantages.

Comments?