On Fri, 11 Mar 2005, Fr�d�ric Giudicelli wrote: > Paul Freeman wrote: > > On Tue, 8 Mar 2005, BOTTAN Romain wrote: > > Thanks for the quick response. I have done a little more research and > > have successfully built a cert using newpki that works as a ssl server > > cert for mozilla/firefox. I added the keyEncipherment extension to the > > extended Key usage extension in the extensions section of the entity I > > used to sign the request. > > > > All works OK now. I am not sure if this is the "correct" solution but > > it works satisfactorily. > > Are you sure you added keyEncipherment to extendedKeyUsage ? Or was it > keyUsage ?
Frederic My apologies:-( I did add it to the keyUsage. serverAuth is assigned to extendedKeyUsage. I came across a document: http://www.die.net/doc/linux/man/man1/x509.1.html which mentions netscape ssl clients conecting to ssl servers. > I thought that keyEncipherment wasn't necessary in keyUsage as long as > you specified serverAuth in extendedKeyUsage. I guess I was wrong. I'm > going to add it to the default template. > > > Perhaps the serverAuth extension is not getting added by newpki even > > though it is specified? Would this also solve the problem? > > That would be weird. > > > Using Internet Explorer 6 SP1, I checked the 2 certs I created, one > > with keyEncipherment and the other without it (all else the same) and > > IE shows in _both_ instances an enhanced key usage value of Server > > Authentication (OID 1.3.6.1.5.5.7.3.1). > > > > Now I am puzzled! Is IE doing something wrong (adding this attribute itself) > > or is Mozilla doing the "right" thing? > > Could you send me both certificates, I don't need the private keys. > I will send the certs to you directly. Regards Paul +++---+++---+++---+++---+++---+++---+++---+++---+++---+++---+++---+++ EML Consulting Services Pty Ltd Telephone: +61 3 9836 1999 417-431 Canterbury Road Facsimile: +61 3 9836 0517 SURREY HILLS, VICTORIA 3127 Email: [EMAIL PROTECTED] +++---+++---+++---+++---+++---+++---+++---+++---+++---+++---+++---+++ _____________________________________________________________________ NewPKI http://www.newpki.org User Support Mailing List [email protected] Automated List Manager [EMAIL PROTECTED]
