Re: Using OpenSSL on unix to manage certs for Windows boxes (CSR's and PKCS12)

2005-01-14 Thread Dr. Stephen Henson
On Fri, Jan 14, 2005, Victor B. Wagner wrote: > On 2005.01.14 at 17:38:29 +0100, Dr. Stephen Henson wrote: > > > > > Does a GOST CSP exist? > > At least two of them. One is developed by CryptoPro, and other by > CryptoCom. There is third major vendor of certified Russian cryptography > on the m

Re: Using OpenSSL on unix to manage certs for Windows boxes (CSR's and PKCS12)

2005-01-14 Thread Victor B. Wagner
On 2005.01.14 at 17:38:29 +0100, Dr. Stephen Henson wrote: > > Does a GOST CSP exist? At least two of them. One is developed by CryptoPro, and other by CryptoCom. There is third major vendor of certified Russian cryptography on the market, but I don't know if they have their own CSP implementati

Re: Using OpenSSL on unix to manage certs for Windows boxes (CSR's and PKCS12)

2005-01-14 Thread Dr. Stephen Henson
On Fri, Jan 14, 2005, Victor B. Wagner wrote: > On 2005.01.14 at 17:02:51 +0300, Vsevolod Stakhov wrote: > > |>For MSIE you can use Xenroll for that. > > | BTW, it is not clear for me how to create DSA certificates from xenroll. > > | (really I oo need GOST94 certificates, not DSA) > > > > You ca

Re: Using OpenSSL on unix to manage certs for Windows boxes (CSR's and PKCS12)

2005-01-14 Thread Victor B. Wagner
On 2005.01.14 at 17:02:51 +0300, Vsevolod Stakhov wrote: > |>For MSIE you can use Xenroll for that. > | BTW, it is not clear for me how to create DSA certificates from xenroll. > | (really I oo need GOST94 certificates, not DSA) > > You can use such kind of script for IE: I see that this script d

Re: Using OpenSSL on unix to manage certs for Windows boxes (CSR's and PKCS12)

2005-01-14 Thread Vsevolod Stakhov
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Victor B. Wagner wrote: | On 2005.01.13 at 13:55:37 +0100, Dr. Stephen Henson wrote: | |>It doesn't. You can do that of course but the preferred technique is the same |>as every other environment: create a private key on the microsoft box, sign a |>requ

Re: Using OpenSSL on unix to manage certs for Windows boxes (CSR's and PKCS12)

2005-01-14 Thread Victor B. Wagner
On 2005.01.13 at 13:55:37 +0100, Dr. Stephen Henson wrote: > It doesn't. You can do that of course but the preferred technique is the same > as every other environment: create a private key on the microsoft box, sign a > request with it, send request to the CA and install the resulting certificate.

Re: Using OpenSSL on unix to manage certs for Windows boxes (CSR's and PKCS12)

2005-01-14 Thread Shaun Lipscombe
* Bernhard Froehlich wrote: > Shaun Lipscombe wrote: > > ><>[...] > >One last question... it's to do with client certificates. If I have two > >websites, say, and they both require client certificates signed by the > >CA "ABC. Ltd" there is nothing stopping a client certificate being used > >for

Re: Using OpenSSL on unix to manage certs for Windows boxes (CSR's and PKCS12)

2005-01-13 Thread Bernhard Froehlich
Shaun Lipscombe wrote: <>[...] One last question... it's to do with client certificates. If I have two websites, say, and they both require client certificates signed by the CA "ABC. Ltd" there is nothing stopping a client certificate being used for authorization to access both sites even though th

Re: Using OpenSSL on unix to manage certs for Windows boxes (CSR's and PKCS12)

2005-01-13 Thread Dr. Stephen Henson
On Thu, Jan 13, 2005, Shaun Lipscombe wrote: > * Dr. Stephen Henson wrote: > > > On Thu, Jan 13, 2005, Shaun Lipscombe wrote: > > > > > Another question I have is I have seen documentation on the net showing > > > CSR's being generated that catenate the private key and PEM encoded > > > certific

Re: Using OpenSSL on unix to manage certs for Windows boxes (CSR's and PKCS12)

2005-01-13 Thread Shaun Lipscombe
* Dr. Stephen Henson wrote: > On Thu, Jan 13, 2005, Shaun Lipscombe wrote: > > > Why is it that a Microsoft box requires SSL certificates be imported > > from a PCKS12 file when all other operating systems and software are OK > > with a PEM certificate? > > It doesn't. You can do that of course

Re: Using OpenSSL on unix to manage certs for Windows boxes (CSR's and PKCS12)

2005-01-13 Thread Dr. Stephen Henson
On Thu, Jan 13, 2005, Shaun Lipscombe wrote: > I have used openssl to setup a CA to sign site certificates and client > certificates. All is working just great , however I have a couple of > questions to ask so that I dont go insane. > > Why is it that a Microsoft box requires SSL certificates b