Re: Force usage of a certificate for client authentication

2011-01-28 Thread Martin Boßlet
> With my newsgroup/mailing list moderator hat on, I write: > >   PLEASE DO NOT reply to this list by multiple addresses. >   Please reply to no more than one of the following addresses: > >      mozilla-dev-tech-cry...@lists.mozilla.org >              dev-tech-cry...@lists.mozilla.org >      mozil

Re: Force usage of a certificate for client authentication

2011-01-27 Thread Nelson B Bolyard
With my newsgroup/mailing list moderator hat on, I write: PLEASE DO NOT reply to this list by multiple addresses. Please reply to no more than one of the following addresses: mozilla-dev-tech-cry...@lists.mozilla.org dev-tech-crypto@lists.mozilla.org mozilla.dev.tech.cr

Re: Force usage of a certificate for client authentication

2011-01-27 Thread Martin Boßlet
> Did you check your client certificate in Firefox 4 to make sure it's > imported correctly? > > In Firefox 4, open Options (or Preferences) > Advanced > Encryption > > View Certificates > Your Certificates.  Is your client certificate > listed? Yes, it's there. But it was also in Firefox 3.6.13,

Re: Force usage of a certificate for client authentication

2011-01-27 Thread Wan-Teh Chang
On Thu, Jan 27, 2011 at 6:06 AM, Martin Boßlet wrote: > > But I again checked the trust settings for the CA certificates. > They're fine... Did you check your client certificate in Firefox 4 to make sure it's imported correctly? In Firefox 4, open Options (or Preferences) > Advanced > Encryption

Re: Force usage of a certificate for client authentication

2011-01-27 Thread Martin Boßlet
Sorry I hadn't seen the other replies yet, I answered to Robert via mail and had not yet seen the code references Wan-Teh posted. Thanks for all your help! Hmm it's really weird - the code references seem to indicate that the missing (extended) key usage extension is not the reason for the certifi

Re: Force usage of a certificate for client authentication

2011-01-26 Thread Martin Boßlet
Hi, thanks for your help! I considered the custom CA certificate as a reason, too. That's why I verified that the client certificate's root certificate is imported and trusted, as is the root certificate of the server. I also verified with OpenSSL that the remote server sends the entire chain cor

Re: Force usage of a certificate for client authentication

2011-01-26 Thread Robert Relyea
On 01/26/2011 04:38 AM, Martin Boßlet wrote: > Hello, > I'm facing this problem currently with Firefox (3.6.13 Linux): > > I want to authenticate to a server using TLS client authentication, so > I imported a PKCS#12 file for this purpose. > Unfortunately the certificate is from an internal CA that

Re: Force usage of a certificate for client authentication

2011-01-26 Thread Wan-Teh Chang
On Wed, Jan 26, 2011 at 4:38 AM, Martin Boßlet wrote: > > I want to authenticate to a server using TLS client authentication, so > I imported a PKCS#12 file for this purpose. > Unfortunately the certificate is from an internal CA that does neither > issue keyUsage, extendedKeyUsage > nor NetscapeC

Force usage of a certificate for client authentication

2011-01-26 Thread Martin Boßlet
Hello, I'm facing this problem currently with Firefox (3.6.13 Linux): I want to authenticate to a server using TLS client authentication, so I imported a PKCS#12 file for this purpose. Unfortunately the certificate is from an internal CA that does neither issue keyUsage, extendedKeyUsage nor Netsc