Andrew Brady wrote:
>
> MY WORK AROUND
> ==============
>
> I have decided, unless anyone can give me a strong reason
> why not, to, for MSIE certificates, to place the uid in
> the CN attribute. e.g.:
>
> C=EU, O=ECMWF, CN=Andy Brady (myuid)[EMAIL PROTECTED]
>
> This will force any local app programmers to write code
> specifically to parse the uid out of the CN, if the
> uid attribute does not exist. If at a future date
> I can include uid, no app code needs to change.
>
It depends on what you mean by "uid". If its the Netscape weird OID you
want then you might try:
0.9.2342.19200300.100.1.1=my uid
> NEXT PROBLEM
> ============
>
> So I now have an SSL client cert that works in Netscape (4.7)
> and MSIE5 but does not work in MSIE4.
>
> MSIE4 appears to accept the certificate and places it in
> the certificate database. Unfortunately it does not show
> it in it's list under View->Internet Options->Content->Personal.
>
> The certificate is there though as certmgr sees it.
>
Standard IE4 bug. You need to set the Xenroll enrollment script to
create a key exchange key, by default it uses a signature key. This is
done with:
Xenroll.KeySpec = 1
Xenroll.GenKeyFlags = 3
The second one isn't strictly speaking necessary but it allows the user
to set the security level instead of giving them none at all...
Steve.
--
Dr Stephen N. Henson. http://www.drh-consultancy.demon.co.uk/
Personal Email: [EMAIL PROTECTED]
Senior crypto engineer, Celo Communications: http://www.celocom.com/
Core developer of the OpenSSL project: http://www.openssl.org/
Business Email: [EMAIL PROTECTED] PGP key: via homepage.
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
