Subject: Client X509 Certificate import in Netscape 6.2

From: Colm McCartan <[email-masked]>
Date: Wed, 30 Jan 2002 13:53:02 +0000

Hello all,

Thanks to a previous post on here with regard to IE client certificates 
(http://marc.theaimsgroup.com/?l=openssl-users&m=100320729122227&q=raw), we were 
able to successfully import certificates to IE and set up full client 
verification over SSL using openssl and Apache/modSSL - anyone needing help with 
this please feel free to mail me.

However, we have a problem achieving the same in Netscape 6.2 - I have seen a 
few snippets here and there, mostly relating to older versions of Communicator, 
that suggest the browser can only import keys via http (?!) with an appropriate 
MIME type set. I have also seen reference to a custom <KEYGEN> tag that gets the 
browser to generate a keypair and produce a CSR. There doesn't seem to be a 
simple import option in the Certificate Manager. We'll obviously have a problem 
importing the CA root certificate also.

On a related note, when the browser is refused access to the SSL site, a 
nasty-looking dialog comes up saying an unidentified SSL error (-12227) has 
occurred - is there a way to trap this and maybe give a more 
friendly/informative response or a redirect?

Any clues gratefully accepted,

colm
................................................................
colm mccartan
panasonic owl uk
[email-masked]
(44) 131 561 1035

______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: Colm McCartan <[email-masked]>
Date: Wed, 30 Jan 2002 15:19:17 +0000

Replying to my own question, but for the archive...

The same PKCS12 file used for importing to IE can be used to import the client 
PKCS record to NS (at least 6.2 - a colleague is getting an unspecified error 
with 6.1)... Simplpy use the (slightly misnamed) Restore button in the 
Certificate Manager to browse to the .p12 file - after importing the root CA by 
drag and drop or the same process.

Still interested in the associated problem:

> nasty-looking dialog comes up saying an unidentified SSL error (-12227) 
> has occurred - is there a way to trap this and maybe give a more 

Cheers,
colm