The problem is Netscape's alias-key.db and alias-cert.db file format.
Using Netscape utilities, you generate the key pair.
The admin server has a link that will generate the CSR.
You can cut and paste the CSR and submit it to a CA.
When I tried to run it through OpenSSL, it complains about not being able
to load the private key.
If I use OpenSSL to generate the key, request, and certificate, I can try
to install it,
but I don't then have the necessary ability to install them as *.db files
where Netscape expects them.
I either need the ability to extract the Netscape server private key for
signing the certificate using OpenSSL,
or a db_load utility going back the other direction. Also, as a footnote,
Netscape only uses 512 bits, not 1024.
Jim
Dr S N Henson
<[EMAIL PROTECTED]> To: [EMAIL PROTECTED]
Sent by: cc:
owner-openssl-users@o Subject: Re: generating
self-signed certificate for Netscape
penssl.org Enterprise Server
08/24/00 02:20 PM
Please respond to
openssl-users
[EMAIL PROTECTED] wrote:
>
> Sorry, this is long.
>
> I would like to generate a self-signed Certificate for internal testing
> purposes.
> I've downloaded OpenSSL 0.9.5a and have played a bit with the utilities.
>
> Netscape Enterprise (Suitespot) Server provides the means to generate
> key-pairs, and Certificate Signing Requests.
> Great. I can submit them to a trusted CA and pay the fee... There is
not
> a utility for generating Certificates directly.
> The key-pairs are stored in a Berkeley DB 1.85 database format. Fine.
> I've downloaded DB185 utilities...
>
> With all these tools, I still can't get what I need.
>
> If I could generate a self-signed certificate from the CSR that Netscape
> produces, I could use Netscape admin server
> to install it, and life would be good. But I need the server's private
key
> in either PEM or DER format. Using db_dump185
> I can extract the certificate request and public key info in text format,
> but this is not very useful with the openssl utilities...
>
> I can use openssl to generate keys and signing requests, and even self
> signed certificates, but then I have no way to
> import them into the DB185 database format that Netscape requires.
>
> Has anyone seen this before? I can't be the first to walk this plank.
> I've read the docs, searched the FAQ's, and performed trial and error til
> blue...
>
> Please, someone put me out of my misery.
> Either tell me I can't get there from here, or please give me the magic
> formula.
>
> (I know, use Apache instead. Ha, ha.)
>
Check out my homepage for a method that will extract keys on some
versions of Netscape servers. There may however be a problem using self
signed certificates. I know Netscape clients wont use self signed S/MIME
certificates.
Any reason why you can't create a CA for test purposes using OpenSSL and
sign the request?
Steve.
--
Dr Stephen N. Henson. http://www.drh-consultancy.demon.co.uk/
Personal Email: [EMAIL PROTECTED]
Senior crypto engineer, Celo Communications: http://www.celocom.com/
Core developer of the OpenSSL project: http://www.openssl.org/
Business Email: [EMAIL PROTECTED] PGP key: via homepage.
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
