Re: cert extension: authority key identifier (AKI)

2009-11-24 Thread Jean-Marc Desperrier
Eddy Nigg wrote: Interestingly I /think/ NSS is the only library which really has a problem with it, to all of my knowledge (and I might be wrong with that) You might. Openssl (therefore mod_ssl, etc.) also has a problem when it doesn't match. I think most other library also have a problem

Re: cert extension: authority key identifier (AKI)

2009-11-24 Thread Jean-Marc Desperrier
Nelson B Bolyard wrote: CAs that make this mistake typically have to abandon and completely replace their entire PKI (entire tree of issued certificates) when a CA cert expires and its serial number appears in the AKI of other subordinate certs. More than once I've seen entire corporate PKIs

Re: Building NSS for OpenCSW (Solaris)

2009-11-24 Thread Jean-Marc Desperrier
Maciej Bliziński wrote: I'd like to pass the -L and -R flags via environment variables For anyone else, CSW packages use this to tell the builds to use /opt/csw/lib to locate their dependencies. What's the best way to make the NSS build read LDFLAGS and LD_OPTIONS? That's a very valid

Re: cert extension: authority key identifier (AKI)

2009-11-24 Thread Ian G
On 24/11/2009 10:25, Jean-Marc Desperrier wrote: Nelson B Bolyard wrote: CAs that make this mistake typically have to abandon and completely replace their entire PKI (entire tree of issued certificates) when a CA cert expires and its serial number appears in the AKI of other subordinate certs.

Firefox Certificate window

2009-11-24 Thread Stefan Jordanov
Hello everybody, I am wondering how can I show a X509Certificate with javascript or something like that in the Firefox certificate window? Is this possible with window.crypto? Thank you in advance. Best regards, Stefan Jordanov -- dev-tech-crypto mailing list

Re: Firefox Certificate window

2009-11-24 Thread Stefan Jordanov
As as say Firefix certificate window I mean Firefox certificate viewer. Best regards, Stefan Jordanov On 24 Ноем, 17:45, Stefan Jordanov stefanste...@gmail.com wrote: Hello everybody, I am wondering how can I show a X509Certificate with javascript or something like that in the Firefox

Re: question regarding PK11_FindFixedKey() in pk11skey.c

2009-11-24 Thread Marc Kaeser
Thank you for your help, I'll answer directly into your answers, too: Robert Relyea schrieb: If I remember well, the PKCS11 specs tell that there's exactly 1 crypto-object per token (soft or hardware). FALSE- A token can and does regularly have multiple crypto-objects active at any given

Re: question regarding PK11_FindFixedKey() in pk11skey.c

2009-11-24 Thread Robert Relyea
Thank you for your help, I'll answer directly into your answers, too: Robert Relyea schrieb: If I remember well, the PKCS11 specs tell that there's exactly 1 crypto-object per token (soft or hardware). FALSE- A token can and does regularly have multiple crypto-objects active at any given

Re: question regarding PK11_FindFixedKey() in pk11skey.c

2009-11-24 Thread Nelson B Bolyard
On 2009-11-24 13:00 PST, Marc Kaeser wrote: Are there unpersistant keys in a token? I'll also look for that point in the specs. Yes, in the PKCS#11 model, *ALL* objects (key objects, cert objects, etc.) live in tokens. All crypto engines live in tokens, too, at least conceptually. Some