Re: My shy certificate

2006-08-11 Thread Nelson Bolyard
Dave Pinn wrote: > Nelson Bolyard wrote: >> A week after applying for his certificate, he download the certificate >> onto the same desktop box where he had generated the CSR, which combined >> the cert and private key in the same mozilla softoken module. Then he >> "exported" the cert and private

Re: My shy certificate

2006-08-11 Thread Dave Pinn
Some more information: I notice that in one scenario, the one where the private key is marked 'not available' in ProtectTools, there appears a button in the Certificate Viewer, labelled 'Install Certificate...'. Naturally, I push the button. I am led through the Certificate Import Wizard, wh

Re: My shy certificate

2006-08-11 Thread Dave Pinn
Peter Djalaliev wrote: ...It seems that all private keys (thank you for the correction here) generated in the TPM never leave it, unless they are marked as migratable and are migrated to another TPM. The corresponding public keys can be exported In support of your conclusion: the ProtectTools

Re: My shy certificate

2006-08-11 Thread Dave Pinn
Nelson Bolyard wrote: A week after applying for his certificate, he download the certificate onto the same desktop box where he had generated the CSR, which combined the cert and private key in the same mozilla softoken module. Then he "exported" the cert and private key into a PKCS#12 file, whi

Re: Can firefox use personal certificates from the Windows store

2006-08-11 Thread Rich Raffenetti
"Robert Relyea" <[EMAIL PROTECTED]> wrote in message news:[EMAIL PROTECTED] > On Mon, 2006-07-31 at 21:52 -0500, Rich Raffenetti wrote: >> e certificates are auto enrolled and are replaced every month. We >> don't >> wish for our 3500 users (even 10% of them) to have to export and >> import the

Re: My shy certificate

2006-08-11 Thread Peter Djalaliev
Oh, well, I understood that Dave used his Mozilla browser only to navigate to the CA website and click the "Buy Now" button, not to generate his own private key and CSR. Can Firefox generate private keys? I though that none of the NSS functionality (except for signing and verifying text) was expo

Re: My shy certificate

2006-08-11 Thread Peter Djalaliev
Nelson Bolyard написа: > I would expect that these details all go on beneath the PKCS#11 API layer, > and are all hidden inside of the PKCS#11 module. I suspect that the wrapped > keys (wherever they physically reside) still appear as PKCS#11 objects in > the PKCS#11 "slot" or "token", and would