I have generated a self-signed certificate authority using mydomain.org as the common name.
I imported the public certificate using Thunderbird's certificate manager under the "Authorities" tab. So far so good.

Next, using this CA, I have generated (and signed) a certificate for mail.mydomain.org, but even though I imported the CA, I keep getting the "Add Security Exception" popup with the message "Unknown Identity" when I'm trying to connect for the first time. Here's a screenshot that illustrates the situation:

![popup, mail certificate, authorities, trust, CA](https://i.stack.imgur.com/TYNIH.png)

Note: Both the CA and the mail certificate are signed using "SHA-1 With RSA Encryption".  

Note 2: I understand that I should get a certificate from a trusted authority, this is a temporary solution. 

So my questions are:

1) Is this behavior normal?  

2) How do I "convince" Thunderbird that all certificates signed by my CA are trusted?

**UPDATE**

```
% openssl s_client -connect mail.mydomain.org:993
CONNECTED(00000003)
depth=1 <snip> CN = mydomain.org, <snip>
verify error:num=19:self signed certificate in certificate chain
verify return:0
---
Certificate chain
 0 s:/<snip>/CN=mail.mydomain.org/<snip>
   i:/<snip>/CN=mydomain.org/<snip>
 1 s:/<snip>/CN=mydomain.org/<snip>
   i:/<snip>/CN=mydomain.org/<snip>
---
Server certificate
-----BEGIN CERTIFICATE-----
<BASE64>
-----END CERTIFICATE-----
subject=/<snip>/CN=mail.mydomain.org/<snip>
issuer=/<snip>/CN=mydomain.org/<snip>
---
No client certificate CA names sent
---
SSL handshake has read 2807 bytes and written 567 bytes
---
New, TLSv1/SSLv3, Cipher is AES256-SHA
<long apparently irrelevant output snipped>
    Verify return code: 19 (self signed certificate in certificate chain)
---
* OK [CAPABILITY IMAP4rev1 UIDPLUS CHILDREN NAMESPACE THREAD=ORDEREDSUBJECT THREAD=REFERENCES SORT QUOTA IDLE AUTH=PLAIN ACL ACL2=UNION] Courier-IMAP ready. Copyright 1998-2011 Double Precision, Inc.  See COPYING for distribution information.

```