On Mon, Dec 09, 2002, wen ding wrote:
hi,
I try to use openssl to issue and manage certificates for internal usage.
I generated CA ROOT certificate with utility from openssl and issued server
certificate signed by the CA ROOT. The server certificate and CA ROOT worked
very well with iplanet fasttrack 4.1, a early version web server from sun.
After that I tried to use it with iplanet enterprise 5.5, the server
certificate can be installed sucessfully. But the CA ROOT certificate can be
recognized by iplanet enterprise 5.5, but when I tried to add it, the system
failed with the message:
Incorrect Usage:Invalid certificate
The server could not import one of the certificates.
I found all ROOT CA from commerical CA can cooperate well with iplanet
enterprise and in version field of all certificates from commericial CA 'V3'
indicates that X509 version 3. In all certificates issued from openssl, the
version field is filled with 'V1'. There are also other differences, such as
fields issuing organization key id and subject key id do not exist in
certificates from openssl.
Besides the problem as stated above, the crl generated from openssl either
can not work under iplanet enterprise and its version is also 'V1' while
revocation list from commericial product is 'V3'.
As i am a newbie in using openssl, i welcome anyone provide me with any
advice. Thanks in advance.
My email is [EMAIL PROTECTED]
Great thanks!
dingwen from China
You haven't mentioned what technique you used to generate the certificates
with OpenSSL. If you'd used CA.pl (see manual page) it would create V3
certificates and include the extensions you mention.
OpenSSL by default creates V1 CRLs because some versions of Netscape chokes on
them. By adding extensions it can create a V2 CRL. Not sure what you mean by a
V3 CRL do you have an example you could post?
Steve.
--
Dr. Stephen Henson [EMAIL PROTECTED]
OpenSSL Project http://www.openssl.org/~steve/
__
OpenSSL Project http://www.openssl.org
Development Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
