Hello!
I have a certificate, which is supposed to be used for s/mime signatures and
tls-client authentication:
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 157 (0x9d)
Signature Algorithm: sha1WithRSAEncryption
Issuer: CN=Foo
Validity
Not
On Friday 14. December 2012 17:08:02 you wrote:
> Hi Patrick ,
>
>
> I actually don't want to use the file that is generated from
> sautil. For security reasons - i delete the private key from disk and
> rely on the one stored inside the HSM partition. I've been directed to
> use the fol
Hy!
Is it possible to create a timestamp response with "openssl ts" with a private
key stored on a PKCS#11 token?
cheers
Mat
__
OpenSSL Project http://www.openssl.org
User Support Mailing List
On Tuesday 13. August 2013 06:17:35 redpath wrote:
> I have a best practices question on CA management for signing.
>
> I have created CA signing cert and issue all other certs using this
> CA to sign them.
>
> 1) I noticed that many CA examples set a term of 3650 days, is this commmon
> practice
On Wednesday 14. August 2013 04:10:23 you wrote:
> Thanks and as for the last question number (5) I meant I simply replace the
> SSL cert and assume there
> will be a challenge to accept the new certificate by a browser? I revoke the
> old one SSL cert.
I still don't get it. If you have revoked yo
If you create a selfsigned certificate, the signature algorithm will obviously
be that of the public key of the certificate. If you use an EC key, you can
only end up with a ecds-with* signature. If you want sha1WithRSAEncryption,
you need to create a RSA key. Or have your EC-certificate signed
On Tuesday 01. October 2013 02:56:16 you wrote:
> Hi,
>
> I am very new to OpenSSL.
>
> I would like to understand how exactly CRL is used.
>
> Means, lets say, we try to login using gmail.com in any browser. Now we see
> certificates - We see Google Inc is the 1st level and it has a CRL which i
Just a wild guess: If you click on "edit trust" on the root certificate in
Firefox, you have to tick the box for web server certificates.
cheers
Mat
On Friday 04. October 2013 21:29:57 you wrote:
> Hello,
>
> there exists a self signed root CA certificate (A)
> one intermediate CA certificate (
You can add a "caIssuer" entry to the "authorisInformationAccesss" extension
of cert B and C. Put an URL where you can download the issuing certificate (so
cert C has a URL to download cert B). That way, windows can automatically
fetch the intermediate certificate.
cheers
Mat
On Tuesday 12. No
I agree with Walter, that it is not exactly good practise to have a CA key
lying around on multiple servers. But anyway, if you need to do it you have to
create the random serial number externally by some script and write it into
the serial file (as set in the openssl configuration file used) pr
openssl can use a PKCS#11 interface in some scenarios, but you won't need it
for what you want to do.
I'd advise you to get the actual PKCS#11 standard document. For each function,
there is always some sample code included.
cheers
Mat
On Monday 28. April 2014 23:32:21 you wrote:
> Need some bas
Some standards (like the CA/Browser Forum guidelines) request a certain amount
of entropy (like 20 bits) to be contained within the serial number. Is there
some sort of best-practice for incorporating this small amount of real random
data into a larger unique serial number?
cheers
Mat
On Tuesd
Hy!
If I have suspended (crlReason=certificateHold) a certificate in the past an
now want to really revoke it using "openssl ca", I get an error message
"ERROR:Already revoked, serial number 01". Is there some way to make openssl
automaticalls "upgrade" the suspension to a revocation with havin
A further related question: Is there some way to remove a suspended
certificate from a CRL without manually editing the index file? Using the "-
crl_reason removeFromCRL" option on the ca command does not work.
cheers
Mat
On Friday 02. May 2014 14:35:23 you wrote:
> Hy!
>
> If I have suspended
14 matches
Mail list logo