Hello all,
Having managed to download and play with the new 2.0.0rc1 release (debian
package) for a little while, I've compiled a short list of feature requests:
1. It doesn't appear to be possible at the moment to set an absolute
certificate expiry time; for example, you can set the CA validity to 9125 days
(i.e. 25 years) but you cannot set the certificate to expire on exactly 31
December 2049 at 23:59:59. The OpenSSL library allows this kind of date
setting, because the OpenSSL command line allows you to set absolute start and
end dates. Could this be included in the program?
2. You can set a child CA to expire (and also, I think, a non-CA certificate
issued by a CA) on a date after its parent CA expiry date. This should not be
allowed (and is possibly the cause of Peter Param's error message:
Id: 2
State: Error during certification
Type: PKCS#12
CA: SVMHS_CA_SSL
<------------------------------------------------>
X509 V3 routines #123
unable to get issuer keyid
[v3_akey.c:151]
<------------------------------------------------>
[...]
but I'm still investigating that.)
3. In the Registration Authority, it does not appear to be possible to alter
the certificate extensions on a single certificate request. Normally this
would be sensible, but what about the situation where you need to insert an
alternative subject name for a server that has more than one DNS name, for
example, on just one certificate? How do you do that at the moment? I don't
think it's possible.
Does anyone have any comments?
Gary H
--
Gary Hawkins <[EMAIL PROTECTED]>
_____________________________________________________________________
NewPKI http://www.newpki.org
User Support Mailing List [email protected]
Automated List Manager [EMAIL PROTECTED]
