Hi Rob,
On Fri, 2006-01-06 at 09:21 -0500, Rob Crittenden wrote:
Mark McLoughlin wrote:
> Hi,
> A couple of quick questions about things that have been bugging me:
>
> - If I import a server certificate and a CA certificate with pk12util
> and change the trust attributes on the CA cert to "C,," - i.e. that
> it should be a trusted CA for server certificates - and then start
> slapd I get:
>
> [05/Jan/2006:17:21:57 +0000] conn=0 op=-1 fd=64 closed - No certificate authority is
trusted for SSL client authentication.
>
> Which seems strange to me - I would have thought the CA certs in
> nssckbi would be trusted for client auth?
The C trust flag means that it is a trusted CA to issue server certs.
For client certs you need the T flag as well.
Right.
nssckbi doesn't really come into play here. I believe that even
if your
CA is signed by another CA that is in libnssckbi but you don't trust
your CA to sign client certs, then any client certificates issued by
your CA won't be trusted.
Well, the point is that this CA won't be issuing an client
certificates ... only a server certificate.
What appears to be happening is that NSS requires at least one CA
certificate to be available in order to send a certificate request
during the handshake. However, my CA certificate isn't trusted for
client auth and NSS isn't aware of any other CAs for client auth, so it
barfs.
I find this puzzling because looking through the NSS code, it looks
like the CA certificates from nssckbi should be used for client auth -
e.g. the error suggests that if I make my CA trusted for client auth, it
will be the *only* CA used for client auth and that the root CAs will be
ignored?
Cheers,
Mark.