John Smith wrote: > nospam said the following on 9/11/2005 7:47 PM: >>> I recommend you re-post to the crypto newsgroup/mailing list, and >>> provide a little more background on what you are trying to do.
That's a great idea. The mozilla crypto newsgroup, not the security newsgroup. mozilla.dev.tech.crypto >> I'll repost...but just in case you are curious, the web site is >> self-signed, and the browser owner will not be allowed onto the web >> pages unless they belong to a group of people who have their own >> personal ssl certs. Those personal ssl certs would be signed by my >> server's self-signed ca. Your CA should be issuing certs, not making key pairs. Your CA should not ever hold the users' private keys. >> Only I'm not finding documentation on how to >> create the key pairs in a format that mozilla can import, the pkcs12 You shouldn't be doing that. The end user should hold his own private key. He should generate his own key pair. He should send you a cert signing request (CSR) which contains only his public key (not private key). Your CA should sign that CSR, making a cert. He should download that cert. No PKCS12 file involved. mozilla has all the code built in to - generate key pairs - generate signed CSRs - send the signed CSRs in as part of a POST http request - download and install the cert from an http URL All publicly documented for, oh, about 10 years now. > This link has information on how to create certificates and export them > to PKCS12 format. > > http://www.google.com/notebook/public/03698530817572601055/BDRUxIgoQupmI9rQh I wouldn't recommend that page as a basis for operating a CA. /Nelson B, mozilla crypto developer. _______________________________________________ dev-tech-crypto mailing list [email protected] https://lists.mozilla.org/listinfo/dev-tech-crypto
