On Fri, 2006-01-06 at 10:47 -0500, Rob Crittenden wrote:
Mark McLoughlin wrote:
> What appears to be happening is that NSS requires at least one
CA
> certificate to be available in order to send a certificate request
> during the handshake. However, my CA certificate isn't trusted for
> client auth and NSS isn't aware of any other CAs for client auth, so it
> barfs.
>
> I find this puzzling because looking through the NSS code, it looks
> like the CA certificates from nssckbi should be used for client auth -
> e.g. the error suggests that if I make my CA trusted for client auth, it
> will be the *only* CA used for client auth and that the root CAs will be
> ignored?
The question is: Do you want to do client certificate authentication? If
not then you should be able to disable client auth in the directory
server and this message should go away. I'm not a FDS developer so I
can't really say how one would do this configuration.
Yep, if you disable client auth, no attempt is made to send a
certificate request during the handshake and you don't get any error.
(To disable it you seem to have to set both "nsslapd-sslclientauth" on
"cn=config" and "nsSSLClientAuth" on
"cn=encryption,cn=config")
As for the trust issue, this goes a bit beyond my knowledge. This
would
be a good question for the NSS guys in the
netscape.public.mozilla.crypto newsgroup (on
nntp://news.mozilla.org).
Okay, thanks for your help.
Cheers,
Mark.