Update an SSL Certificate in Thunderbird

Op 22 October 2012, a StartCom Ltd. (startssl.com) intermediate certificate expired, used by Thunderbird for a secure connection to snews://news.eternal-september.org/ (port 563). So that stopped working and Thunderbird was only able to reach the free newsgroup server of Eternal September via the standard, insecure connection (port 119). This situation should really be rectified by the server admin or the Thunderbird developers, but the user can also solve the problem. For that, a new certificate must be downloaded and installed. The weakest link in the chain of trust is then that download. If that is acceptable, proceed as follows:

  1. Download the new certificate from https://www.startssl.com/certs/sub.class1.server.ca.crt (right-click, Save As).
  2. Screenshots are from Thunderbird for Mac, version 16.0.2. step0
  3. Start Thunderbird, open Preferences from the application menu. step1
  4. Click the Advanced tab, the Certificates page, the "View Certificates" button. step2
  5. In the Certificate Manager, click the page Authorities, scroll down to "StartCom Ltd.", select (click) "StartCom Class 1 Primary Intermediate Server CA", click the "Delete or Distrust…" button. step3
  6. Confirm deletion. step4
  7. The expired certificate has been deleted. Click the "Import…" button. step5
  8. Select your downloaded certificate from step 1. (Some OS X system labels in this screenshot are in Dutch.) step6
  9. Check the box: "Trust this CA to identify web sites", optionally click View to examine the certificate, click OK. step7
  10. The updated certificate is listed. Click OK. step8
  11. Select (click) the newsgroup account Eternal September. It might have a different name. Click: "View settings for this account". step9
  12. Click "Server Settings", at "Connection security" select: SSL/TLS, check the Server Name (news.eternal-september.org) en the Port (563), click OK. step10

Ready. Your secure connection to Eternal September should work again.