Subject: AW: Creating client certificates ?

From: "Hertha, Maik (Hartmann + Hertha)" <[email-masked]>
Date: Wed, 3 Apr 2002 10:01:20 +0200

you are not right. there are lot of resources.
you should look here: http://www.modssl.org/docs/2.8/ssl_faq.html

mit freundlichem Gruß /
best regards

Maik Hertha

-------------------------------------------------------------- h+h
EBSP Anwenderbetreuung, +49 5361 9-74950
Volkswagen AG / Brieffach 1721 / D-38436 Wolfsburg
http://ebsp.wob.vw.de              
[email-masked]
--------------------------------------------------------------
hartmann+hertha
it (beratung / entwicklung / support)
http://www.hartmann-hertha.de
[email-masked]
-------------------------------------------------------------- h+h

> -----Ursprüngliche Nachricht-----
> Von:	[email-masked] [SMTP:[email-masked]]
> Gesendet am:	Mittwoch, 3. April 2002 03:56
> An:	[email-masked]
> Betreff:	Creating client certificates ?
> 
> Hello modssl users !
> 
> I managed to set up an ssl aware web server.
> Although I searched the web and also the list
> archive I haven't been able to create a client
> certificate which is signed by my own CA for
> client authentication.
> 
> Could someone describe the process of creating
> such a certificate in detail ?
> 
> I know it is possible with openssl but as I said
> before I wasn't able to figure out how.
> 
> Please help !
> 
> -- 
> GMX - Die Kommunikationsplattform im Internet.
> http://www.gmx.net
> ______________________________________________________________________
> Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
> User Support Mailing List                      [email-masked]
> Automated List Manager                            [email-masked]
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: [email-masked]
Date: 4 Apr 2002 09:11:08 -0000

here is what i did to generate client sertificates. be aware of the 
clientakey.pem and clienta.pem are two different files.

1. openssl req -new -out clienta.csr -keyout clientakey.pem

Enter the details for the certificate, i.e common name being the 
client/employee, \
"Joe Bloggs".

2. openssl x509 -req -in clienta.csr -out clienta.pem -CA 
YOUR_SERVERS_CERTIFICATE \
-CAkey YOUR_SERVERS_PRIVATE_KEY -CAcreateserial -days 365 -outform PEM

3. openssl pkcs12 -export -in clienta.pem -out clienta.p12 -inkey 
clientakey.pem \
-name "Joe Bloggs"

Distribute clienta.p12 (rename clienta.p12 to Joe_Bloggs.p12) to 
client/employee.

Haldor.

On Thu, 4 Apr 2002 01:43:05 +0200 (MEST) [email-masked] wrote:
>[email-masked] wrote:
>Thank you Owen for your answer but you misunderstood
>my question.
>And you Maik misunderstood my question, too.
>I, of course, read the FAQ and all the other available docs
>but they say nothing about creating client (!) certificates !
>The process of creating a server certificate is sufficiently
>documented in the FAQ and it was no problem for me to
>create it.
>
>My question is: How can I create client (!) certificates for
>                     client authentication to the server and not
>                     server certificates ?!
>
>Anyone ?
>
>--

---

From: Shiraz Esat <[email-masked]>
Date: Thu, 4 Apr 2002 10:02:16 +0100

When a client browser reaches an SSL-secured page, the browser checks to 
see whether the 'server' certificate is trusted. In Internet Explorer 5.5, 
you can view a list of trusted certificates from: (Menu) Tools|Internet 
Options... -> Content TAB | Certificates.. BUTTON.
You should be able to view all installed certificates.

These certificates have either been pre-installed, or installed when 
visiting an SSL-site and agreeing to download. This is how a 'client' 
certificate exists.

An easy way of getting hold of the 'client certificate' that you yourself 
have signed (mine is attached) is by going to your own site and agreeing to 
trust your site (!). The certificate would then be installed on your 
machine. Then view all installed certificates (explained above for IE), and 
Export the certificate.

Doing all this allows you to pass on a copy of your certificate to someone, 
and tell them to Import it into their trusted list. I feel it's all a bit 
unneccesary, but now you should be "able to create a client certificate 
which is signed by my own CA for client authentication." !

Shiraz

-----Original Message-----
From:	[email-masked] [SMTP:[email-masked]]
Sent:	Thursday, April 04, 2002 12:43 AM
To:	[email-masked]
Subject:	Re: Creating client certificates ?

Anyone ?