Your logic is correct, in Thunderbird, you have the preferences|advanced and
this shows you a set of tabs, the last one of which is "Certificates". Press
View Certificates Button and you get another dialog with 4 tabs
1.- the first tab (your certificates) is for the pk12 ones
2.- other people's certs, for the pem of other people
3.- websites certs
4.- and authorities to put your CA cert.
Just make sure your certificate is actually one "son" of your CA.
It is right To make one CA cert with the 509 extensions set to CA
X509v3 Basic Constraints:
CA:TRUE
X509v3 Key Usage:
Certificate Sign, CRL Sign
Netscape Cert Type:
SSL CA, S/MIME CA
But it is a mistake to make the "son" as ANOTHER SELF SIGNED cert with those
extensions not set as CA
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Cert Type:
SSL Client, SSL Server, S/MIME, Object Signing
X509v3 Key Usage:
Digital Signature, Non Repudiation, Key Encipherment
Netscape Comment:
I know of important companies doing this mistake.
The second cert has to be one SIGNED by the first CA authority, not a
selfsigned one with CA fields "off" of false.
Said in other words: the second cert is the result or output of a CSR
(certificate signing request) signed by the CA cert.
Thunderbird accepts PEM format, so you don't need the DER transformation.
The above outputs are part of "openssl x509 -in anycert.pem -text"
David Hlacik wrote:
>
> Hello,
>
> i have working nnrpd with SSL configuration. I am using my custom
> generated
> SSL certificate signed with my own Certification Authority. Each time i am
> accessing news in Windows Mail client i am getting message , that
> certificate is not trusted and cannot be verified.
> I want to get rid off this message by importing my custom CA (or probably
> custom certificate) into windows certification storage and make it trusted
> so i will not get this message again.
>
> So far, i have converted my cacert.pem to der format using :
> openssl x509 -inform PEM -outform DER -in cacert.pem -out cacert.der
>
> Then, i have converted my nnrpd certificate to pk12 format using:
> openssl pkcs12 -export -clcerts -in nnrpd.cert.pem -inkey nnrpd.key.pem
> -out
> clcert.p12
>
> Then i have by clicking on cacert.der and following tutorial installed CA
> certificate into Windows Vista. In second step by clicking on clcert.p12 i
> have installed client certificate.
> But so far, it is not working and i am allways getting message about not
> trusted certificate.
>
> Can someone help me please, or point me to solution?
>
> Thanks in advance!
>
> Regards,
>
> David
>
>
--
View this message in context:
http://www.nabble.com/using-NNTPS-%28nnrp-with-ssl%29-with-windows-mail---thunderbird-on-windows-vista-tp18069198p18069930.html
Sent from the OpenSSL - User mailing list archive at Nabble.com.
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List openssl-users@openssl.org
Automated List Manager [EMAIL PROTECTED]
