> Hi, I see this option when I import but I don't understand something > more fundamental. Why doesn't the cert itself have any password > protection? Is it because when I created it I specified the key > password only to build the cert from the key? And the cert gets built > with no protection? > > Thanks.
Standard tools are designed enforce the standard security model. In the standard security model, certificates only contain public identity information. If you have your own non-standard security model where certificates need to be kept secret, you have to write your own software that enforces that security model and ensure that your keys and certificates are never used by software that doesn't understand how you want them to be used. I would strongly urge you, however, to adopt the standard security model. It is well-studied and well-understand and in crypto, "rolling your own" is a high-risk operation. The standard model does not provide a way to protect certificates. Why do you think you need to? DS ______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List [email protected] Automated List Manager [EMAIL PROTECTED]
