Bill Price wrote:
>
> I ran into this same problem under a slightly different scenario. I had a
> key pair and cert that were issued from a NS cert server. The cert had a
> short validity period and expired. Rather than generate new keys I reissued
> a certificate using the CA. I too found out that I could not install the new
> certificate in MS until I imported the PKCS #12 file. However, I then was
> not able to read messages in my sent mail folder that had been encrypted
> using the old certificate. Does the CryptoAPI inherently limit the number of
> certificates associated with a private key to one or is it possible to
> associate multiple certificates with the same private key? (My query to the
> CryptoAPI list went unanswered.) Thanks.
>
Well certificates under CryptoAPI contain a "property" that points to
the corresponding private key. As such there's no reason why you can't
have more than one certificate per key. The documentation is rather poor
in this regard. It may do something horrible when you set the property
of a certificate: like deleting the property on any certificate that
points to the same container.
You might want to check to see if it still says you have the
corresponding private key for both certificates.
It uses the "friendly name" of the key to build the key container name
when you import a PKCS#12 file so you might try using the same key with
different names. This would end up having two copies of the same key.
There may however be application specific restrictions that stop you
having more than one certificate per key so it may be impossible.
Steve.
--
Dr Stephen N. Henson. http://www.drh-consultancy.demon.co.uk/
Personal Email: [EMAIL PROTECTED]
Senior crypto engineer, Celo Communications: http://www.celocom.com/
Core developer of the OpenSSL project: http://www.openssl.org/
Business Email: [EMAIL PROTECTED] PGP key: via homepage.
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
