On Tue, 8 Mar 2005, BOTTAN Romain wrote: > Funny, I had this problem this morning and investigated a long time in it, > (just for info for peoples who want to use the PKCS#12 file with apache > they need to enter command > /etc/apache-ssl# openssl pkcs12 -nodes -in pkiserver.p12 -out > pkiserver.pem) > the error : > > "Could not establish an > encrypted connection because certificate presented by ... is invalid > or corrupted. Error code: -8102". > > is marked as a bug in mozilla bug tracking site, > the best comment i found is : > > "This server's cert has an Extended Key Usage extension, which says this > cert is usable for international use, but does NOT say that it is usable > as an SSL server. > > Specifically, your cert's Extended Key Usage extension contains OID > SSL Step Up (2 16 840 1 113730 4 1) (Netscape) > but does not contain OID > serverAuth (1 3 6 1 5 5 7 3 1) (PKIX key purpose) > Thanks for the quick response. I have done a little more research and have successfully built a cert using newpki that works as a ssl server cert for mozilla/firefox. I added the keyEncipherment extension to the extended Key usage extension in the extensions section of the entity I used to sign the request.
All works OK now. I am not sure if this is the "correct" solution but it works satisfactorily. Perhaps the serverAuth extension is not getting added by newpki even though it is specified? Would this also solve the problem? Using Internet Explorer 6 SP1, I checked the 2 certs I created, one with keyEncipherment and the other without it (all else the same) and IE shows in _both_ instances an enhanced key usage value of Server Authentication (OID 1.3.6.1.5.5.7.3.1). Now I am puzzled! Is IE doing something wrong (adding this attribute itself) or is Mozilla doing the "right" thing? Thanks again Paul +++---+++---+++---+++---+++---+++---+++---+++---+++---+++---+++---+++ EML Consulting Services Pty Ltd Telephone: +61 3 9836 1999 417-431 Canterbury Road Facsimile: +61 3 9836 0517 SURREY HILLS, VICTORIA 3127 Email: [EMAIL PROTECTED] +++---+++---+++---+++---+++---+++---+++---+++---+++---+++---+++---+++ _____________________________________________________________________ NewPKI http://www.newpki.org User Support Mailing List [email protected] Automated List Manager [EMAIL PROTECTED]
