Install HKUST CA Certificates

Preparation

Before installing the HKUST CA Certificates, update your Internet tools to their latest version such as:

• Internet Explorer version 6 or above
• Firefox version 3 or above
• Thunderbird 2.x or above
• Microsoft Outlook 2002 SP3 or above
• Netscape version 7.1 or above, etc.

Installation of HKUST CA Certificates

Before your internet tools (e.g. Internet Explorer, Netscape, etc.) are able to verify digital certificates issued by the HKUST Certification Authority (HKUST CA), it is required to install the HKUST CA Certificates into each of the tools that you are using. For example, your email utility (Microsoft Outlook, Netscape Messenger) can verify email message signed by the HKUST Personal (Smartcard) e-Cert when the HKUST CA Certificates are in place.

Below are the installation steps for the commonly used email clients / internet tools:

• Internet Explorer in Windows 7, Vista and XP (including Microsoft Outlook, Outlook Express)
• Firefox
• Thunderbird
• Netscape (including Netscape Messenger)

Internet Explorer in Windows 7, Vista and XP

1. Open Internet Explorer and browse to the following link to download the certificates,

   Download HKUST Certification Authority Certificates

2. Click Open and then Allow to open the downloaded certificate file. For Vista, you may need to click Continue to allow the file to open.
   
3. Determine which certificate class to install according to the intended purpose :
   • For web site validation - install the Root and Server e-Cert
   • For email signature verification - install the Root, Role, Personal and Personal (Smartcard) e-Cert
   • For software verification - install the Root and Developer e-Cert
4. Install the required certificate in the certmgr window by :
   • Double click to open it
   • Click Install Certificate... to bring out the Certificate Import Wizard
   
   
5. Choose Place all certificates in the following store and then click on Browse...
   
6. In the Select Certificate Store window, check the box Show physical stores
   
7. For HKUST Root CA Certificate, choose Trusted Root Certification Authorities. For all other certificates, choose Intermediate Certification Authorities. Click on the + sign . Choose Local Computer followed by clicking OK
   
   
8. The location of certificate store will then show a Local Computer suffix in the Certificate Import Wizard. Click Next to finish the installation.
   
   
9. To check whether the installation is successful, open the Internet Explorer web browser. On the menu bar, click Tools -> Internet Options
10. On the Content tab, click the Certificates button.
    
11. The installed certificate should shown in the Trusted Root Certification Authorities or Intermediate Certification Authorities tab
    
    

Installation of HKUST CA Certificates for Firefox

1. Open Firefox web browser
2. Click on the following link:

Download HKUST Certification Authority Certificates

3. Check all the check boxes as indicated below and then click OK
   
4. To verify if all the HKUST certificates are imported successfully:
   • On the browser menu bar, click Options... under Tools
   • Click on Advanced and then the View Certificates button on the Encryption tab
     

Installation of HKUST CA Certificates for Thunderbird

1. Right click on the link below and save a copy of the CA certificate chain file. You will need to import the saved file in step 8.

   https://keon.ust.hk/retrieval/send-ca-cert.xuda?cert=all

2. Open Thunderbird
3. Select Tools->Options....
4. For Thunderbird 3.x, click on Advanced, Certificates
   
5. For Thunderbird 2.x, click on Privacy, Security
   
6. Click on View Certificates.
7. Select the Authorities tab.
   
8. Click Import.
9. Browse to the downloaded CA certificates file (step 1) and click Open:
   
10. Check all the check boxes as indicated below and then click OK
    
11. You can verify if all the HKUST certificates are imported successfully.
    
12. For Thunderbird 3.x, go back to the Certificates tab. Click on Validation and uncheck the OCSP option.
    
13. Remove the downloaded CA certificates file (step 1) if necessary.

Installation of HKUST CA Certificates for Netscape

1. Open your Netscape web browser
2. Click on the following link:

   Download HKUST Certification Authority Certificates

3. Click on the Next button to acknowledge both the New Site Certificate windows and the New Site Authority windows until you got the following window:
   
4. Check all the check boxes and click Next to accept all certificates.
5. Enter the nickname HKUST Root CA to identify this Certificate Authority and click Finish
   

   If you are using Netscape 7.1 or above, you will need to explicitly edit the trust settings after you have installed the HKUST CA certificates:

   1. Select Preferences... under the Edit menu
   2. Select Certificates under the Privacy and Security Category
   3. Click on the Manage Certificates button
   4. Click on the Authorities tab
   5. Select HKUST Root CA and click on the Edit button
   6. Check all the options as indicated below