(just for info for peoples who want to use the PKCS#12 file with apache they need to enter command
/etc/apache-ssl# openssl pkcs12 -nodes -in pkiserver.p12 -out pkiserver.pem)
the error :
"Could not establish an encrypted connection because certificate presented by ... is invalid or corrupted. Error code: -8102".
is marked as a bug in mozilla bug tracking site, the best comment i found is :
"This server's cert has an Extended Key Usage extension, which says this
cert is usable for international use, but does NOT say that it is usable
as an SSL server.
Specifically, your cert's Extended Key Usage extension contains OID SSL Step Up (2 16 840 1 113730 4 1) (Netscape)
but does not contain OID
serverAuth (1 3 6 1 5 5 7 3 1) (PKIX key purpose)
In effect, this extension explicitly says that this cert is NOT valid
for server authentication. AFAIK, no standards compliant client should
authenticate a server with that particular cert extension in it.
IMO, your choices are to eliminate the Extended Key Usage extension entirely or add the serverAuth key purpose OID in it also. "
but when I look in detail in the options of the cert extensions, the OID "serverAuth" is checked. so, i try to find whats wrong, but for now, my solution is to remove all extensions! (if you look at the certificate generated by apache, it a V1 x509, with no options), so it's not worst than the generated one, i think.
(to remove all options, just go in the config window of the child CA corresponding of you're generated server CA, and push button "Manage certificate extensions", then clic on each extensions and push "Delete value", validate your choices, go to the RA, revoke cert, request new, import in your server, and convert it, restart server)
I hope this solution will work for you ;)
best regards,
-- =========================================================== Romain BOTTAN ===========================================================
Paul Freeman wrote:
Hi I am successfully using newpki 2.0-beta4 as a PKI. Thank you Frederic:-)
I have come across an interesting problem when I began using a SSL Server certificate which I created using newpki then installed on apache 2.0.53.
The SSL server cert is signed by an intermediate CA which is in turn signed by the Root CA.
I am using the SSL Server extensions template provided in newpki.
When I access the web site using Internet Explorer 6 I am informed the cert is OK but is not signed by an authority I trust. This is to be expected and is OK.
However, when I access the web site using Firefox 1.0 or Mozilla, I get an alert error in the browser "Could not establish an encrypted connection because certificate presented by ... is invalid or corrupted. Error code: -8102". I cannot go any further after this. I never get to view the cert or accept it.
Any ideas what is causing this? The key length is 1024 bits using a sha1rsa signature algorithm, Basic Constraints CA:False.
I notice the cert does not contain DirName or serial values under the X509v3 Authority Key Identifier section. The keyid value is present. Could this cause the problem?
I have verified the cert using the openssl verify tool. All is OK.
If I create a self-signed cert using the makefile.crt tool of apache (basic constraint CA:true) then both mozilla/FIrefox and Internet Explorer work as expected.
I look forward to your comments.
Regards
Paul +++---+++---+++---+++---+++---+++---+++---+++---+++---+++---+++---+++ EML Consulting Services Pty Ltd Telephone: +61 3 9836 1999 417-431 Canterbury Road Facsimile: +61 3 9836 0517 SURREY HILLS, VICTORIA 3127 Email: [EMAIL PROTECTED] +++---+++---+++---+++---+++---+++---+++---+++---+++---+++---+++---+++
_____________________________________________________________________ NewPKI http://www.newpki.org User Support Mailing List [email protected] Automated List Manager [EMAIL PROTECTED]
-- Analyse du mail sortant.................. OK / AUCUNE TRACE DE VIRUS (VIRUS FREE) Checked by AVG Anti-Virus. Version: 7.0.308 / Virus Database: 266.6.2 - Release Date: 04/03/2005
_____________________________________________________________________ NewPKI http://www.newpki.org User Support Mailing List [email protected] Automated List Manager [EMAIL PROTECTED]
