I knew I could manually accept a certain CA, but what I am not understanding
is that I need to do that.
A. for www.yournic.com the chain is: Thawte (trusted in Netscape) ->
Equifax (not listed in Netscape) -> www.yournic.com
This works as expected.
B. for www.nlfactory.com the chain is: Thawte (trusted in Netscape) ->
Equifax (not listed in Netscape) -> www.yournic.com (not listed in
Netscape)-> www.nlfactory.com
I don't get why A works without any warnings and B not. Maybe Netscape is
limited to 1 intermediate CA only?
Taco
-
----- Original Message -----
From: "Schaefer,Lorrayne J." <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Tuesday, March 06, 2001 3:55 PM
Subject: Re: Chaining CA's
> Taco,
>
> You need to explicitly trust the CAs in your chain in Netscape. To do
this,
> you need to click on the Security icon, select Signers, and then edit
each of
> the CAs in your chain. When you edit each of the CAs, you will see three
> checkboxes. Click on each of the check boxes to accept the CA for each of
the
> three items. This should resolve the problem you're experiencing. Also,
you
> can test to ensure this works by highlighting one of your CAs (I would
pick the
> intermediate CA) and click on the "verify" button. It should return with
a
> this CA was verified correctly message.
>
> Lorrayne
>
> Taco Scargo wrote:
>
> > Hi,
> >
> > I've been experimenting a bit with signing a certificate request with my
> > key/cert combination that was issued/certified by Equifax Secure (which
is
> > certified by Thawte). I added my certified certificate to the
> > SSLCACertificate and SSLCertificateChain files. This works fine in MSIE
and
> > Opera browsers.
> > When I view the chain in MSIE I see:
> >
> > Thawte->Equifax Secure->www.yournic.com (my certified
> > certificate)->www.nlfactory.com
> >
> > In Netscape browsers however I get a warning that the browser does not
> > recognise the signing authority. This probably means that Netscape does
not
> > work correctly with Chained CAs.
> > Is this correct or am I doing something wrong ?
> >
> > The urls to try out:
> >
> > https://www.yournic.com (no warning in Netscape)
> > https://www.nlfactory.com (warning in Netscape
> >
> > Thanks,
> >
> > Taco Scargo
> >
> > ______________________________________________________________________
> > Apache Interface to OpenSSL (mod_ssl) www.modssl.org
> > User Support Mailing List [EMAIL PROTECTED]
> > Automated List Manager [EMAIL PROTECTED]
>
> ______________________________________________________________________
> Apache Interface to OpenSSL (mod_ssl) www.modssl.org
> User Support Mailing List [EMAIL PROTECTED]
> Automated List Manager [EMAIL PROTECTED]
>
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl) www.modssl.org
User Support Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
