RE: [Pki-users] Modify Certificate Profies - removing 'Critical' key-usage indication

While attempting to test various Email clients in a windows environment (including Outlook Express and Outlook), I am having trouble getting the Email client (Outlook Express) to accept the certificates generated by the RedHat/DogTag CA. I am using the 'CAUserCert.cfg' profile and I am adding a SubjectAltName extension as described in my earlier message. However, I am still not successful getting the Email client to use the DogTag user certificates for signature purposes. Is there a documented procedure that describes how to generate user certificates accepted by the windows-based Outlook Express client? Comparing the RadHat user certificate with a Microsoft user certificate reveals that the RedHat CA sets the 'KeyUsage' extension to 'Critical' -- while the Microsoft CA does not! After modifying the DogTag CA Profile ('CAUserCert.cfg') to specify a "non critical" 'KeyUsage' extension, any new request using the modified profile fails - error message is: "Sorry, your request has been rejected. The reason is "Request Rejected - Criticality Not Matched". Are there multiple places I need to adjust the Profile -- so far I have only modified the 'CAUserCert.cfg' file in the '<CA-instance>/profiles/ca' directory. Ebbe @ SPYRUS "This message and any attached documents contain SPYRUS confidential and/or proprietary information and may be subject to privilege or exempt from disclosure under applicable law. These materials are intended only for the use of the intended recipient. If you are not the intended recipient of this electronic message, you are hereby notified that any use of this message is strictly prohibited. Delivery of this message to any person other than the intended recipient shall not constitute any waiver of any privilege. If you have received this message in error, please delete this message from your system and notify the sender immediately. Thank you." -----Original Message----- From: Marc Sauton [mailto:msauton@redhat.com] Sent: Wednesday, April 30, 2008 10:17 AM To: Ebbe Hansen Cc: pki-users(a)redhat.com Subject: Re: [Pki-users] Modify Certificate Profies - include SubjectAltName If in /var/lib/pki-ca/profiles/ca/caUserCert.cfg has policyset.userCertSet.8.default.params.subjAltExtPattern_0=$request.requ estor_email$ policyset.userCertSet.8.default.params.subjAltExtGNEnable_0=true and the enrollment request has an e-mail, the subject alt name extension field should be correctly initialized upon certificate issuance. You may want to turn on some debug in CS.cfg debug.enabled=true debug.level=0 and see your debug log for more details. M. It depends how the request hadEbbe Hansen wrote: ------------------------------------------------------------------------ ------------------------------------------------------------------------ ------------------------------------------------------------------------