> Hi, > I hope I understand you right. > > Controll : if the Client (browser) have that root CA with that you sign > the client.cert.request ? Yes, the root CA installed on the browser is the same as that used to sign the user certificate on the server. To clarify, the loaded XX.pem file can be looked at and verified from within the browser. When the server requests it, though, it does appear to receive the user certificate, but it doesn't appear to verify it. Hope this helps. > hirntod > > > On Fri, 7 Jul 2000, Mac Cody wrote: > > > Hello, > > > > I'm trying to duplicate the creation and loading of client certificates > > into a Netscape browser as described in Hirsch's excellent paper. I've > > had no problem creating the HTML form. The SPKAC data appears to be > > generated correctly and sent to my server. What I am uncertain of is > > the correct openssl function to execute to generated the signed > > certificate from the SPKAC file. > > > > After alot of reading of the documentation and postings in the > > openssl-users archive, I've created the following command that I > > think should generate the signed certificate: > > > > openssl.exe ca -config $userCertDir/clientreq.cnf -spkac > > $userCertDir/spkac.txt \ > > -outdir $userCertDir -out $userCertDir/test.result -batch -key secret > > -verbose > > > > Note that userCertDir is a Tcl variable that specifies the directory > > containing the various files. > > > > This command updates the certificate index and serial number files > > as expected. It also places data in the file XX.pem (where XX is > > the last serial number used) in PEM format and into the file > > test.result in DER(?) format. Is this command correct? > > > > My problem is which of these two new file (XX.pem or test.result) > > do I return to the browser as a document with MIME type of > > application/x-x509-user-cert? I originally thought that the > > test.result file would be used, but the Netscape browser wouldn't > > accept the data (stating it was bad). The broswer appears to > > accept the XX.pem file and a new certificate appears in the > > Security->Yours section of the browser when it is inspected after > > the transaction. > > > > Still, I not sure all is well. When I attempt to access my secure > > web server (Tcl HTTPD 3.0.0 with client certs required and requested), > > I get a prompt that the cert is requested. When I acknowledege the > > request, I get an error message back that the server cannot verify > > the certificate. I know that the client certificate is being sent > > to the server, but it apparently doesn't recognize it. Am I not > > generating the client cert correctly or is there a problem with the > > server set up (or a bug)? The server handles server-side certs > > without any problems. > > > > Thanks for any help provided! > > > > Mac Cody > > -- > > _________________________________________________________________ > > | | | > > | Mac A. Cody | Principal Physics Engineer | > > | Raytheon Systems Co., C3I | email: [EMAIL PROTECTED] | > > | mail stop HA-36110 | phone: (972) 205-6452 | > > | P.O. Box 660023 | or 1-800-752-6163 x6452 | > > | Dallas, TX 75266 | fax : (972) 205-7180 | > > |_______________________________|_________________________________| > > ______________________________________________________________________ > > OpenSSL Project http://www.openssl.org > > User Support Mailing List [EMAIL PROTECTED] > > Automated List Manager [EMAIL PROTECTED] > > > > ______________________________________________________________________ > OpenSSL Project http://www.openssl.org > User Support Mailing List [EMAIL PROTECTED] > Automated List Manager [EMAIL PROTECTED] -- _________________________________________________________________ | | | | Mac A. Cody | Principal Physics Engineer | | Raytheon Systems Co., C3I | email: [EMAIL PROTECTED] | | mail stop HA-36110 | phone: (972) 205-6452 | | P.O. Box 660023 | or 1-800-752-6163 x6452 | | Dallas, TX 75266 | fax : (972) 205-7180 | |_______________________________|_________________________________| ______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
