Re: Importing exporting JKS key to NSS db

2008-06-23 Thread Michael Ströder
Yevgeniy Gubenko wrote: 1.export public key from Solaris to Windows in JKS format 2.import public key from Windows to Solaris into NSS database I would export as PKCS#12 format and import that to NSS cert DB. Ciao, Michael. ___ dev-tech-crypto

Re: New SSL warning

2008-06-23 Thread Jan Schejbal
Hi, Please read the thread about Debian keys first: I did (now completely), but most of it seems to be a discussion about CAs (not) revoking keys. As I understand it, if the CA does use only a normal CRL (and not OCSP), firefox won't care. At least the proof-of-concept attack on the akamai key

https flow

2008-06-23 Thread Pawel P
Hello, I want to overwrite default mozilla 1.9 behavior in https flow. I want to be informed about certificates (especially bad). I'll show my own certificate dialogs to user and user will decide if accept certificate or not. In mozilla 1.8 I used nsIBadCertListener interface to do above. In

Re: New SSL warning

2008-06-23 Thread Eddy Nigg
Jan Schejbal: I did (now completely), but most of it seems to be a discussion about CAs (not) revoking keys. As I understand it, if the CA does use only a normal CRL (and not OCSP), firefox won't care. At least the proof-of-concept attack on the akamai key still worked. Yes, as indicated CRL

Re: Debian Weak Key Problem

2008-06-23 Thread Eddy Nigg
Gervase Markham: Rob Stradling wrote: That is now old news. I'm pleased to announce that... snip applause Gerv StartCom has concluded today the revocation of all vulnerable keys which were signed by any of our roots, respectively intermediate CA certificates. Several notifications were

Re: Update on DigiNotar and Entrust

2008-06-23 Thread Robert Relyea
Frank Hecker wrote: 3. Find some other way to get NSS not to recognize DigiNotar certs for email, perhaps in combination with some action by Entrust and/or DigiNotar. For example, one idea is to have end users of DigiNotar certs reconfigure their email clients to have cert chains that

RE: Importing exporting JKS key to NSS db

2008-06-23 Thread Yevgeniy Gubenko
Thanks Michael for your reply First of all, I don't know how to extract specificly public key after I used the following command: certutil -G -n srv -k rsa -g 1024 -z seed -f pwdfile.txt -d . which should have created me public/private key pair. The second problem is: after I have created JKS

Re: Importing exporting JKS key to NSS db

2008-06-23 Thread Nelson B Bolyard
Yevgeniy Gubenko wrote, On 2008-06-23 12:47: I don't know how to extract specificly public key after I used the following command: certutil -G -n srv -k rsa -g 1024 -z seed -f pwdfile.txt -d . which should have created me public/private key pair. The second problem is: after I have

Re: certutil or PKI for NSS 3.11.9

2008-06-23 Thread Arshad Noor
Nelson, I think you may want to qualify your message in this paragraph, so as to not mislead people who don't understand PKI very well. As I'm sure most people on this list know, every Root CA certificate is a self-signed certificate. There is nothing inherently insecure about such

Re: NSS 3.12 is released

2008-06-23 Thread Gen Kanai
On Jun 24, 2008, at 9:41 AM, Wan-Teh Chang wrote: On Thu, Jun 19, 2008 at 2:11 AM, Jean-Marc Desperrier [EMAIL PROTECTED] wrote: But Firefox 3.0 does not make use of the SQLite support, right ? Quite a pity ... You're right. I added a note to the NSS 3.12 Release Notes to clarify this