On Tue, 8 Mar 2005, BOTTAN Romain wrote: Thanks for the quick response. I have done a little more research and have successfully built a cert using newpki that works as a ssl server cert for mozilla/firefox. I added the keyEncipherment extension to the extended Key usage extension in the extensions section of the entity I used to sign the request.
All works OK now. I am not sure if this is the "correct" solution but it works satisfactorily.
Are you sure you added keyEncipherment to extendedKeyUsage ? Or was it keyUsage ?
I thought that keyEncipherment wasn't necessary in keyUsage as long as you specified serverAuth in extendedKeyUsage. I guess I was wrong. I'm going to add it to the default template.
Perhaps the serverAuth extension is not getting added by newpki even though it is specified? Would this also solve the problem?
That would be weird.
Using Internet Explorer 6 SP1, I checked the 2 certs I created, one with keyEncipherment and the other without it (all else the same) and IE shows in _both_ instances an enhanced key usage value of Server Authentication (OID 1.3.6.1.5.5.7.3.1).
Now I am puzzled! Is IE doing something wrong (adding this attribute itself) or is Mozilla doing the "right" thing?
Could you send me both certificates, I don't need the private keys.
Regards, -- Fr�d�ric Giudicelli http://www.newpki.org _____________________________________________________________________ NewPKI http://www.newpki.org User Support Mailing List [email protected] Automated List Manager [EMAIL PROTECTED]
