Re: Getting cert pem format out of pkcs12?

2007-04-16 Thread Subrata Mazumdar
>> Extract the private key from what? Extract the private key from the Mozilla Certificate/Key DB. >> Extract it with what software? Extract PKCS#8 key from Mozilla Key DB using Mozilla-NSS library. No, PKCS#8 is not the default format that OpenSSL uses for its private key. I do not know what t

Re: Turning on OCSP verification generates many errors

2007-04-16 Thread Kai Engert
Nelson Bolyard wrote: > I wrote (quoting Bill Burns): > > One error I get while attempting to authenticate to an internal site > with my certificate-on-a-smartcard is this one: > "Alert: An internal failure has been detected. It not possible to > complete the requested OCSP oper

Re: Turning on OCSP verification generates many errors

2007-04-16 Thread Kai Engert
[EMAIL PROTECTED] wrote: > On Mar 30, 7:13 pm, "Bill Burns" <[EMAIL PROTECTED]> wrote: > >> Yes -- and we'll have screen shots of example websites that are >> throwing OCSP-related errors because some well-known public CAs >> are not scaled up to fully support OCSP. With Vista, this is >> goin

Re: adding own root certificates to firefox

2007-04-16 Thread Nelson Bolyard
Note: followups directed to mozilla.dev.tech.crypto. [EMAIL PROTECTED] wrote: > I have seen that certificates are stored in the cert8.db file, below > the .mozialla directory in the users home directory. How do I add own root > certificates, or exchange certificates as an administrator, so that

Re: Expiration of trust roots

2007-04-16 Thread Paul Hoffman
At 4:13 AM -0700 4/16/07, Kyle Hamilton wrote: >I should mention that on the [EMAIL PROTECTED] list, there's been a fair amount >of discussion on this topic. The concept that is put forth is that >the trust anchor is the key -- and any metadata that the key surrounds >itself with (such as a certif

Re: Expiration of trust roots

2007-04-16 Thread Kyle Hamilton
I should mention that on the [EMAIL PROTECTED] list, there's been a fair amount of discussion on this topic. The concept that is put forth is that the trust anchor is the key -- and any metadata that the key surrounds itself with (such as a certificate, for ease of trust anchor distribution) is no