Subject: Re: Global ID for IE 5.0 NN 4.5 on Win98 dosen't works

From: [email-masked]
Date: Fri, 22 Feb 2002 21:50:47 GMT

Pablo,
     Did you make the server cerificate yourself? Assuming you flagged it
for IE and NC global_id if so then the browser will only step-up to strong
(128bit) encryption if the certificate that signed it is also in the
browser and has been flagged as a server-gated CA certificate, if you
import the CA certificate into your browser then it will lose the
server-gated flag.  AFAIK the only way to flag a CA certificate as
server-gated is to run a patching program after installing the CA
certificate into the browser (IE dev kit?).  There's some more info in the
MOD_SSL docs about this.
     If you bought the GLOBAL_ID certificate (from Verisign/thawte etc) but
it does not step up then the most likely thing is that you have not
installed an intermediate CA certificate into Apache/MOD_SSL, this is a
common mistake - also note this is the SSLCertificateChainFile directive.
     The reason why your Linux 4.75 gives strong encryption is probably
because it is not encryption crippled (Help... About Communicator, does is
say "This version supports U.S. security" and you won't get 40bit unless
you turn off the ciphers in the browser or server.
Mikey

Pablo Silva <[email-masked]> on 21/02/2002 19:42:44

Please respond to [email-masked]

To:   [email-masked]
cc:

Subject:  Global ID for IE 5.0 NN 4.5 on Win98 dosen't  works

Hi All!

I've tested a web site connection
www.magnetenterprises.com with Netscape Navigator
version 4.5 and IE 5.0 on win98, both browsers show me
128 bits connection without erros.

I have a doubt with my certificate, I made a
GLOBAL_ID certificate for my web site, but ...
 , when I test with Netscape Navigator 4.5 and IE 5.0
both on windows 98, only connect by 40 bits :-(

My web site is on Apache + Linux Suse 7.1
Professional when I connect by Netscape Navigator
version 4.75 on Linux, I can see a 128 bits .., but
when I test with  NN or IE on win98 only I can get 40
bits conecctions..

I don't know what happens, is necesary
configurate some directive for to obligate a 128 bits
conecctions for both browsers NN and IE in Apache?

How I must to do it?

Thanks in advance

Greetings from Chile.
-Pablo

__________________________________________________
Do You Yahoo!?
Yahoo! Sports - Coverage of the 2002 Olympic Games
http://sports.yahoo.com
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

All telephone calls are recorded and may be monitored.

E-mail communication is not secure and may be intercepted
by a third party. This message is confidential to the intended addressee.
If you are not the intended addressee, please inform us immediately and then
delete this message. Virgin One account does not accept responsibility for
changes made to this message after it was sent. Although Virgin One account
believes this e-mail is free of any virus or other defect which may affect a
computer, it is the responsibility of the recipient to ensure that it is
virus free and Virgin One account does not accept any responsibility for any
loss or damage arising from its use.

The Virgin One account is a secured personal bank account with The Royal Bank
of Scotland plc administered by Virgin Direct Personal Finance Ltd. It is an
Introducer representative only of Virgin Money Personal Financial Service Ltd,
which is authorised by the Financial Services Authority for life insurance,
pension and unit trust business and represents only the Virgin Money marketing
group.

Registered office: Waterhouse Square, 138-142 Holborn, London EC1N 2TH, UK.
Registered in England no 3414708.
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: Pablo Silva <[email-masked]>
Date: Sat, 23 Feb 2002 17:03:32 -0800 (PST)

Hi Mikey !

    You have rigth!, I forget the step about tag my
certificate make myself for NN and IE.

    When I pathed NN with fortify it worked!, about IE
(my version is for spanish people), only I downloaded
the patch from Microsoft and worked!!

     Hurra...AL FIN!!! :-D

    The web page about the patch for 128 bits you can
find in microsoft, depends of your
language-configuration and version of IE, that's:

http://www.microsoft.com/windows/ie/downloads/recommended/128bit/default.asp

  I don't know why microsoft offer this patch, when
early time only US citizen in USA, could to use 128
bits.

  Well, thanks for your suggestion.

  All of the days I learn new things..

-Pablo