Re: Self-signed CA problem for internal web application

2010-09-23 Thread Chris Rider
Thanks for the suggestion, but I've already tried that, more or less My web server config already has that mime type configured, and the client is capable of recognizing the properly served filetype. I've tried installing certificates through IE's wizard automatically in such a way... as we

Re: Self-signed CA problem for internal web application

2010-09-23 Thread Chris Rider
Sorry, I think I should make clear that I'm using two different setups... one for the CA and another for the end user certificate. For example, my CA is in /etc/pki_MessageNet/CA while my end-user is in /etc/pki_MessageNet/tls --- so when I generate my CA keys, it has its own config file / sco

Re: Self-signed CA problem for internal web application

2010-09-23 Thread Chris Rider
I think we're on to something here... thank you for your time and attention, btw! I still can't see anything about the AIA thing, but I took another go at the basicConstraints and keyUsage, and seem to have slightly better results. I changed basicConstraints to True (it was FALSE by default),

Re: Self-signed CA problem for internal web application

2010-09-23 Thread Chris Rider
Sure.. but please excuse me as this is the first time posting on this forum ~ post in plain text or does this system support attached files? Patrick Patterson wrote: Hi Chris: Can you post the certificates in question? My guess is that you don't have the various extensions set according to t

Re: Self-signed CA problem for internal web application

2010-09-22 Thread Patrick Patterson
Hi Chris: On 2010-09-22, at 4:13 PM, Chris Rider wrote: > For now, I've just copied the CA's public .crt file to a public_html type > directory and downloading on the client ~ from there, depending on whether I > use FireFox or IE, I go into the respective certificates manager and import > the

Re: Self-signed CA problem for internal web application

2010-09-22 Thread John R Pierce
On 09/22/10 11:57 AM, Chris Rider wrote: We have a client/server architecture based product that needs to allow SSL communication between our server (CentOS) and various clients' web browsers (and additionally, other devices, but that's beyond the scope of this post). We've been able to get

Re: Self-signed CA problem for internal web application

2010-09-22 Thread Chris Rider
For now, I've just copied the CA's public .crt file to a public_html type directory and downloading on the client ~ from there, depending on whether I use FireFox or IE, I go into the respective certificates manager and import the one I downloaded. I've been very deliberate in making sure it ac

Re: Self-signed CA problem for internal web application

2010-09-22 Thread Patrick Patterson
Hi Chris: Can you post the certificates in question? My guess is that you don't have the various extensions set according to the PKIX standards that the Browsers are expecting. Thanks. Patrick. On 2010-09-22, at 2:57 PM, Chris Rider wrote: > We have a client/server architecture based product

Re: Self-signed CA problem for internal web application

2010-09-22 Thread Hugo Garza
Hi Chris, how are you installing the root CA on the client machines? In windows once you double click the root certificate you get a message dialog box and click the install certificate button. On the following screen press next and on the next screen tell it to install the certificate to the Trus

Self-signed CA problem for internal web application

2010-09-22 Thread Chris Rider
We have a client/server architecture based product that needs to allow SSL communication between our server (CentOS) and various clients' web browsers (and additionally, other devices, but that's beyond the scope of this post). We've been able to get SSL working in both of two different ways

Self-signed CA problem for internal web application

2010-09-22 Thread Chris Rider
We have a client/server architecture based product that needs to allow SSL communication between our server (CentOS) and various clients' web browsers (and additionally, other devices, but that's beyond the scope of this post). We've been able to get SSL working in both of two different ways (