Re: Using OpenSSL on unix to manage certs for Windows boxes (CSR's and PKCS12)

2005-01-14 Thread Shaun Lipscombe
* Bernhard Froehlich wrote: Shaun Lipscombe wrote: [...] One last question... it's to do with client certificates. If I have two websites, say, and they both require client certificates signed by the CA ABC. Ltd there is nothing stopping a client certificate being used for authorization

Re: Using OpenSSL on unix to manage certs for Windows boxes (CSR's and PKCS12)

2005-01-14 Thread Victor B. Wagner
On 2005.01.13 at 13:55:37 +0100, Dr. Stephen Henson wrote: It doesn't. You can do that of course but the preferred technique is the same as every other environment: create a private key on the microsoft box, sign a request with it, send request to the CA and install the resulting certificate.

Re: Using OpenSSL on unix to manage certs for Windows boxes (CSR's and PKCS12)

2005-01-14 Thread Vsevolod Stakhov
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Victor B. Wagner wrote: | On 2005.01.13 at 13:55:37 +0100, Dr. Stephen Henson wrote: | |It doesn't. You can do that of course but the preferred technique is the same |as every other environment: create a private key on the microsoft box, sign a

Re: Using OpenSSL on unix to manage certs for Windows boxes (CSR's and PKCS12)

2005-01-14 Thread Victor B. Wagner
On 2005.01.14 at 17:02:51 +0300, Vsevolod Stakhov wrote: |For MSIE you can use Xenroll for that. | BTW, it is not clear for me how to create DSA certificates from xenroll. | (really I oo need GOST94 certificates, not DSA) You can use such kind of script for IE: I see that this script does

Re: Using OpenSSL on unix to manage certs for Windows boxes (CSR's and PKCS12)

2005-01-14 Thread Dr. Stephen Henson
On Fri, Jan 14, 2005, Victor B. Wagner wrote: On 2005.01.14 at 17:02:51 +0300, Vsevolod Stakhov wrote: |For MSIE you can use Xenroll for that. | BTW, it is not clear for me how to create DSA certificates from xenroll. | (really I oo need GOST94 certificates, not DSA) You can use such

Re: Using OpenSSL on unix to manage certs for Windows boxes (CSR's and PKCS12)

2005-01-14 Thread Victor B. Wagner
On 2005.01.14 at 17:38:29 +0100, Dr. Stephen Henson wrote: Does a GOST CSP exist? At least two of them. One is developed by CryptoPro, and other by CryptoCom. There is third major vendor of certified Russian cryptography on the market, but I don't know if they have their own CSP

Re: Using OpenSSL on unix to manage certs for Windows boxes (CSR's and PKCS12)

2005-01-14 Thread Dr. Stephen Henson
On Fri, Jan 14, 2005, Victor B. Wagner wrote: On 2005.01.14 at 17:38:29 +0100, Dr. Stephen Henson wrote: Does a GOST CSP exist? At least two of them. One is developed by CryptoPro, and other by CryptoCom. There is third major vendor of certified Russian cryptography on the market,

Using OpenSSL on unix to manage certs for Windows boxes (CSR's and PKCS12)

2005-01-13 Thread Shaun Lipscombe
I have used openssl to setup a CA to sign site certificates and client certificates. All is working just great , however I have a couple of questions to ask so that I dont go insane. Why is it that a Microsoft box requires SSL certificates be imported from a PCKS12 file when all other operating

Re: Using OpenSSL on unix to manage certs for Windows boxes (CSR's and PKCS12)

2005-01-13 Thread Dr. Stephen Henson
On Thu, Jan 13, 2005, Shaun Lipscombe wrote: I have used openssl to setup a CA to sign site certificates and client certificates. All is working just great , however I have a couple of questions to ask so that I dont go insane. Why is it that a Microsoft box requires SSL certificates be

Re: Using OpenSSL on unix to manage certs for Windows boxes (CSR's and PKCS12)

2005-01-13 Thread Shaun Lipscombe
* Dr. Stephen Henson wrote: On Thu, Jan 13, 2005, Shaun Lipscombe wrote: Why is it that a Microsoft box requires SSL certificates be imported from a PCKS12 file when all other operating systems and software are OK with a PEM certificate? It doesn't. You can do that of course but the

Re: Using OpenSSL on unix to manage certs for Windows boxes (CSR's and PKCS12)

2005-01-13 Thread Dr. Stephen Henson
On Thu, Jan 13, 2005, Shaun Lipscombe wrote: * Dr. Stephen Henson wrote: On Thu, Jan 13, 2005, Shaun Lipscombe wrote: Another question I have is I have seen documentation on the net showing CSR's being generated that catenate the private key and PEM encoded certificate request

Re: Using OpenSSL on unix to manage certs for Windows boxes (CSR's and PKCS12)

2005-01-13 Thread Bernhard Froehlich
Shaun Lipscombe wrote: [...] One last question... it's to do with client certificates. If I have two websites, say, and they both require client certificates signed by the CA ABC. Ltd there is nothing stopping a client certificate being used for authorization to access both sites even though those