> From: [email protected] On Behalf Of Ashok Kumar
> Sent: Monday, 15 February, 2010 16:01
> I understand it as any browser like firefox, IE etc do NOT need any
> private key but CA certificates to communicate over SSL with any
> server application, so we dont need to install the key at all. But if
Yes relying parties need the CA cert, never the CA privatekey.
Depending on the server(s) you (will) communicate with, a browser
*may* need a CA cert added, or may already have it. Conversely,
*if* you use client auth -- which the public web mostly doesn't --
the server may need a CA cert added or may already have it.
Each server (or client if using client auth) does need its *own*
(entity) privatekey and (matching) cert.
> we have to import server certs & key into applications like app
> server, LDAP server then how safe is the following openssl command?
>
As a rule best practice is for each entity (server) to generate
its own keypair and obtain a cert for it. But if you need
a server to use a keypair/cert generated elsewhere -- either
because the generation is separate from the server(s), or because
you have multiple servers and want to use one shared keypair/cert
for all -- then yes PKCS12 transport is the good and common way.
(There may be other options in particular situations.)
> openssl pkcs12 -export -out cacert.p12 -in cacert.pem -inkey cakey.pem
>
But naming it cakey and cacert is at best grossly misleading.
You should do this only for (files containing) entity key/cert,
and (generally) should have filenames reflect their contents.
Perhaps something like Chatahoochie_HRwebsvr42_{key,cert} etc.
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List [email protected]
Automated List Manager [email protected]
