Subject: Client Certificate questions

From: Ron Gage <[email-masked]>
Date: Wed, 20 Feb 2002 09:04:25 -0500

Hi Folks:

I am having problems getting a self-signed identity (client) cert installed into
my browsers (Mozilla 0.9.8 and Netscape 4.78).

The cert is signed and tested to be valid, I just can't find the right method to
install it into my browser.  I even tried copying the ident.crt to ident.pem and
browsing it with the browsers.  This installed the cert as a server cert, not an
identity cert.

Can anyone provide any hints on how to install a client cert?  Thanks!

-- 
Ron Gage - Owner, Linux Network Services - Saginaw, Michigan - 989-274-8088
Your one-stop source for Reliable, Secure and Affordable Networking Solutions

-------------------------------------------------
This mail sent through IMP: http://horde.org/imp/

______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: Laurie Young <[email-masked]>
Date: Wed, 20 Feb 2002 14:46:54 +0000 (GMT)

Hi

I have an apache set has a directoy configured so taht only browsers with
a certificate signed from the correct CA can access it.

What I would like to do is that the DN of the certifiacte set as an
envirnment variable.

Can anyone tell me how to do this?

Laurie

-- 
==================================================
              Laurie Robert Young
[email-masked]  |       [email-masked]
www.wildfalcon.com     |  www.doc.ic.ac.uk/~laurie
              ICQ UIN #20194782
==================================================

---

From: CAM <[email-masked]>
Date: Wed, 20 Feb 2002 15:16:57 +0000

> Can anyone provide any hints on how to install a client cert?  Thanks!

Ron,

Not certain about the versions here - I was using NS6.2 on windoze which I 
believe has the same codebase as Moz 0.9.6, no?

Anyway, in the Certificate Manager, we used the (perhaps slightly misnamed) 
Restore function to pick up a PKCS#12 file from the local filesystem. This was 
just the client certificate reworked into PKCS#12 format with openssl - the 
restore file dialog filters for .p12's...

HTH
colm

---

From: Göran Fröjdh <[email-masked]>
Date: Wed, 20 Feb 2002 16:38:02 +0100

> Can anyone provide any hints on how to install a client cert?  Thanks!

In Netscape and Mozilla, you can import a standard pkcs12 certificate (.pk12
extension), but it's a bit more tedious. It's done via Netscape Prefences >
Privacy & Security > Certificates. Click on "Manage Securities" and
"Restore". Enter your signed certificate, and it will install itself.
/goran

---

From: Ron Gage <[email-masked]>
Date: Wed, 20 Feb 2002 11:41:38 -0500

Quoting Göran Fröjdh <[email-masked]>:

> > I am having problems getting a self-signed identity (client) cert
> installed into my browsers (Mozilla 0.9.8 and Netscape 4.78).
> > 
> > The cert is signed and tested to be valid, I just can't find the right
> method to install it into my browser.  I even tried copying the ident.crt to
> ident.pem and browsing it with the browsers.  This installed the cert as a
server cert, not an identity cert.
> "Restore". Enter your signed certificate, and it will install itself.

Great.  I tried the following:

root@net:/home/ron# openssl x509 -in ident.crt -out ident.p12 -outform pkcs12

I tried to import this file into netscape and into mozilla.  No go - they both
complain that the cert is corrupted.  I guess this begs the question: how does
one go about creating the pkcs12 format certificate?

Thanks

---

From: CAM <[email-masked]>
Date: Wed, 20 Feb 2002 17:16:12 +0000

> one go about creating the pkcs12 format certificate?

Try:

openssl pkcs12 -in client.crt -inkey client.key -certfile ca.crt -out client.p12 
-export

The filenames should be self-explanatory - let me know if not.

HTH
colm

---

From: "tom porter" <[email-masked]>
Date: Wed, 20 Feb 2002 12:14:10 -0500

> method to install it into my browser.  I even tried copying the 
> ident.crt to ident.pem and browsing it with the browsers.  This 
> installed the cert as a
> In Netscape and Mozilla, you can import a standard pkcs12 certificate 
> (.pk12 extension), but it's a bit more tedious. It's done via Netscape

> Prefences > Privacy & Security > Certificates. Click on "Manage 
> Securities" and "Restore". Enter your signed certificate, and it will 
> install itself. /goran

This doesn't work for me (FreeBSD 4.4 - mozilla). Mozilla dumps core.
Don't know why...

root@net:/home/ron# openssl x509 -in ident.crt -out ident.p12 -outform
pkcs12

I tried to import this file into netscape and into mozilla.  No go -
they both complain that the cert is corrupted.  I guess this begs the
question: how does one go about creating the pkcs12 format certificate?

openssl pkcs12 -export -in server_cert.pem -inkey server_key.pem -out
yourcert.p12
Enter Export Password:
Verifying password - Enter Export Password:

---

From: Ron Gage <[email-masked]>
Date: Wed, 20 Feb 2002 12:45:07 -0500

> openssl pkcs12 -in client.crt -inkey client.key -certfile ca.crt -out

It worked!  Thank you everyone for your assistance.

Time to write a HOWTO on this - sheeze!