[19530] in Kerberos_V5_Development
NSS PKINIT requires nsCertType extension?
daemon@ATHENA.MIT.EDU (Matt Rogers)
Tue Jan 31 10:10:37 2017
MIME-Version: 1.0
From: Matt Rogers <mrogers@redhat.com>
Date: Tue, 31 Jan 2017 10:09:57 -0500
Message-ID: <CAAeFVfxrTwp6rKW3c2=HZH6ga+0=fnzmYAjQ0Gvp-j9YgCU97g@mail.gmail.com>
To: krbdev@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krbdev-bounces@mit.edu
When building with --with-pkinit-crypto-impl=nss and running the test
suite, I found that PKINIT related tests fail on certificate
verification (either client or KDC certificate depending on the test)
with SEC_ERROR_INADEQUATE_CERT_TYPE : "Certificate type not approved
for application." It turns out NSS is expecting the Netscape
certificate type extension (nsCertType = client/server in
openssl.cnf), and adding it to the test certificates made the tests
pass. Is this expected, or documented anywhere? I've not seen
nsCertType required for SSLClient and SSLServer usage profiles before,
so I'm not sure why it is expected here. My version of NSS is 3.27 by
the way.
Regards,
Matt
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
