Re: Help adding private CA to cert7 file with NSS 3.6

2008-10-06 Thread Nelson B Bolyard
Matthews, Tim R wrote, On 2008-10-06 05:50: >> Now, about that diagnostic step, please try the following series of certutil >> commands using the same cert DB that you used in your original > > trmatthe@:~/working$ certutil -d . -M -t ",," -n client > trmatthe@:~/working$ certutil -d . -M -t "C,,

Re: Microtec CA inclusion request

2008-10-06 Thread Kyle Hamilton
I'll assume he meant Microsec instead of Microsoft, and work from there. (bug 370505) -Kyle H On Mon, Oct 6, 2008 at 3:26 PM, Eddy Nigg <[EMAIL PROTECTED]> wrote: > On 10/06/2008 11:30 PM, Frank Hecker: >> >> We can consider this in the longer term. In the short term Kálmán >> Kéménczy of the Mo

Re: Microtec CA inclusion request

2008-10-06 Thread Eddy Nigg
On 10/06/2008 11:30 PM, Frank Hecker: > > We can consider this in the longer term. In the short term Kálmán > Kéménczy of the Mozilla localization team for Hungary has confirmed the > accuracy of the translations in the Microsoft bug, and is willing to > check further translations as needed. > Fra

Re: Microtec CA inclusion request

2008-10-06 Thread Frank Hecker
Eddy Nigg wrote: > On 10/03/2008 12:43 AM, Frank Hecker: >> * This CA is based in Hungary. Though it provides a lot of information >> in English (including a helpful CA hierarchy diagram) unfortunately all >> of its CPS documents are currently available in Hungarian only. > > Frank, I think we sho

Re: Assertation failure in my server test that no ciphers are present or enabled is zero

2008-10-06 Thread Claes Jakobsson
On 6 okt 2008, at 21.14, Julien R Pierre - Sun Microsystems wrote: > SSLsample is outdated code and has been removed from the NSS source > tree > in 3.12.1. See https://bugzilla.mozilla.org/show_bug.cgi?id=359302 > Please use selfserv as a server code sample. Excellent and thanks for the heads

Re: Assertation failure in my server test that no ciphers are present or enabled is zero

2008-10-06 Thread Julien R Pierre - Sun Microsystems
Claes, Claes Jakobsson wrote: > Hi, > > I'm writing a test-case for the Perl bindings that basically is just > server from SSLsample. However when I try to connect to it I get an > assertation failure: PR_Assert (s=0x86d2c "numPresent > 0 || numEnabled > == 0", file=0x86ced "ssl3con.c", ln=670

Re: Microtec CA inclusion request

2008-10-06 Thread Ian G
Nelson B Bolyard wrote: > István Zsolt BERTA wrote, On 2008-10-06 06:54: >> We had good reasons to choose this solution. According to Hungarian >> regulations, a qualified CA is allowed to use its private key for the >> following two purposes only: >> * signing qualified end-user certificates and

Re: Unable to change password of FIPS enabled internal key token

2008-10-06 Thread Wan-Teh Chang
2008/10/6 Kai Engert <[EMAIL PROTECTED]>: > Wan-Teh Chang wrote: >> >> - The password must be at least seven characters long. >> - The password must consist of characters from three or more character >> classes (uppercase, lowercase, digits, etc.). >> > > > NSS rejects abcDEF7 although it matches

Re: Microtec CA inclusion request

2008-10-06 Thread Eddy Nigg
On 10/06/2008 03:54 PM, István Zsolt BERTA: > We support the second option (Trusted Responder), where the requester > explicitly trusts the OCSP responder. (In our case the link of trust > is established by our CPS stating the the separate root can be trusted > for signing relevant OCSP responses.)

Re: Microtec CA inclusion request

2008-10-06 Thread Eddy Nigg
Concerning translation tools this search brought me to some possibilities: http://www.google.com/search?q=translate+hungarian+english&sourceid=navclient-ff&ie=UTF-8&rlz=1B3GGGL_enIL280IL280&aq=t -- Regards Signer: Eddy Nigg, StartCom Ltd. Jabber: [EMAIL PROTECTED] Blog: https://blog.startcom

Re: Unable to change password of FIPS enabled internal key token

2008-10-06 Thread Kai Engert
Wan-Teh Chang wrote: - The password must be at least seven characters long. - The password must consist of characters from three or more character classes (uppercase, lowercase, digits, etc.). NSS rejects abcDEF7 although it matches your above description. Kai smime.p7s Description: S

Re: Unable to change password of FIPS enabled internal key token

2008-10-06 Thread Wan-Teh Chang
On Thu, Oct 2, 2008 at 11:11 PM, Subrata Mazumdar <[EMAIL PROTECTED]> wrote: > Hi, > I am using Firefox 3.0.3. I have FIPS enabled the software security > device using "Secuirty Devices" dialog window in PSM. > This step forced me to add password protect the internal Key token > (Software security

Re: Microtec CA inclusion request

2008-10-06 Thread Nelson B Bolyard
István Zsolt BERTA wrote, On 2008-10-06 06:54: > OCSP: > - > According to section 2 of RFC 2560, there are three ways to operate an > OCSP responder: > " >All definitive response messages SHALL be digitally signed. The key >used to sign the response MUST belong to one of the following:

Re: Unable to change password of FIPS enabled internal key token

2008-10-06 Thread Kai Engert
Kai Engert wrote: Subrata Mazumdar wrote: I am using Firefox 3.0.3. I have FIPS enabled the software security device using "Secuirty Devices" dialog window in PSM. This step forced me to add password protect the internal Key token (Software security device). Then, I tried to change the password

Re: Unable to change password of FIPS enabled internal key token

2008-10-06 Thread Kai Engert
Subrata Mazumdar wrote: I am using Firefox 3.0.3. I have FIPS enabled the software security device using "Secuirty Devices" dialog window in PSM. This step forced me to add password protect the internal Key token (Software security device). Then, I tried to change the password of the "internal k

Re: Microtec CA inclusion request

2008-10-06 Thread István Zsolt BERTA
Dear All, Let me reflect to some of the above points. First of all, our public website is www.e-szigno.hu. The webpage at https://srv.e-szigno.hu:/cgi-bin/editugyvedcsv.cgi is a restricted page, it requires a client-side SSL certificate (with certain values in the subject DN), so you should n

Re: Microtec CA inclusion request

2008-10-06 Thread Ian G
Nelson B Bolyard wrote: > Frank Hecker wrote, On 2008-10-02 14:43: >> In accordance with the schedule at >> >>https://wiki.mozilla.org/CA:Schedule Hi Nelson, Hi Frank, Having read the EU directive at length, here are some perspectives. I have not looked at the CA's request in question. (I

RE: Help adding private CA to cert7 file with NSS 3.6

2008-10-06 Thread Matthews, Tim R
Hi. Apologies for the poor use of client/server terminology. I've spent so long talking about the non-SSL part of this that I didn't do the context switch into SSL terms :) You are right in that no client certificates are in use. In testing I just have the CA cert and the LDAPS server cert. >

Re: Microtec CA inclusion request

2008-10-06 Thread Rob Stradling
On Monday 06 October 2008 08:53:01 Rob Stradling wrote: > IINM, FF3 by default has the "When an OCSP connection fails, treat the > certificate as invalid" tickbox set to *disabled*, meaning that most users > won't see browser warnings.  Therefore, IMHO, if Microsec don't think it's a > problem, th

Re: Microtec CA inclusion request

2008-10-06 Thread Nelson B Bolyard
Frank Hecker wrote, On 2008-10-02 14:43: > In accordance with the schedule at > >https://wiki.mozilla.org/CA:Schedule > > I am now opening the first public discussion period for a request from > Microtec Ltd to add the Microsec e-Szigno Root CA root certificate to > Mozilla. This is bug 370

Re: Microsec CA inclusion request

2008-10-06 Thread Rob Stradling
On Thursday 02 October 2008 22:43:02 Frank Hecker wrote: > * Microsec has a separate root used for OCSP, and apparently does not > offer OCSP as a general public service; please see the comments in the > bug. I'd like those of you who are OCSP experts to look at this issue > and tell us if you see