View Issue Details

Jump to NotesJump to History
IDProjectCategoryView StatusDate SubmittedLast Update
0000905Main CAcert Websitepublic2011-01-09 13:062012-02-28 22:15
Reporterhomer Assigned To 
PrioritynormalSeverityfeatureReproducibilityalways
Status newResolutionopen 
PlatformMain CAcert WebsiteOSN/AOS Versionstable
Summary0000905: Unable to sign PDF file with Acrobat
DescriptionHello,

the problem looks like bug 0000812.

PortableSigner program allows to sign pdf files but Acrobat since version 5 no longer accepts CAcert codesigning certificates because there are too many extensions in the codesigning certificate. Guy says Microsoft Office 2010 works also for file (pdf?) signing.

Best regards,

Guillaume (on behalf of Guy guy@scharinger.org)
Additional InformationSo we would need website improve to tick different box for codesigning (full, Adobe, Windows EFS, ???) so the user can choose the extensions for signing.
TagsNo tags attached.
Reviewed by
Test Instructions

Relationships

related to 0000812 needs work CAcert certificate not working with Windows Encrypting Filesystem (EFS) 
related to 0000540 needs feedbackNEOatNHNG No key usage attribute in cacert org certs anymore? 

Activities

INOPIAE

2011-09-13 21:09

updater   ~0002423

If you use a class 3 certificate created after 1 July 2011 the signing with in Acrobat 9.0 works.

jcurl

2011-09-21 06:40

reporter   ~0002479

Tested with CACert Class 3 certificate 0A418A, renewed certificate my Class3 certificate (now has a date of 19.Sep) and Acrobat 8.0 doesn't recognise the certificate. Created also a new Class3 certificate (has a date of 18.Sep) and it won't sign in Acrobat 8.0 either. The properties of the certificate don't show any key usage.
 
"openssl x509 -text" shows
 
Certificate:
     Data:
         Version: 3 (0x2)
         Serial Number: 57238 (0xdf96)
         Signature Algorithm: sha1WithRSAEncryption
         Issuer: O=CAcert Inc., OU=http://www.CAcert.org, [^] CN=CAcert Class 3 Root
         Validity
             Not Before: Sep 18 20:40:22 2011 GMT
             Not After : Sep 17 20:40:22 2013 GMT
         Subject: CN=Jason Curl/emailAddress=jcurl@arcor.de
         Subject Public Key Info:
             Public Key Algorithm: rsaEncryption
             RSA Public Key: (2048 bit)
                 Modulus (2048 bit): <snip>
                 Exponent: 65537 (0x10001)
         X509v3 extensions:
             X509v3 Basic Constraints: critical
                 CA:FALSE
             Netscape Comment:
                 To get your own certificate for FREE head over to http://www.CAcert.org [^]
             X509v3 Extended Key Usage:
                 E-mail Protection, TLS Web Client Authentication, Code Signing, Microsoft Individual Code Signing, Microsoft Commerc
 ial Code Signing, Microsoft Encrypted File System, Microsoft Server Gated Crypto, Netscape Server Gated Crypto
             Authority Information Access:
                 OCSP - URI:http://ocsp.cacert.org [^]
             X509v3 Subject Alternative Name:
                 email:jcurl@arcor.de

Uli60

2012-02-21 22:19

updater   ~0002835

test #1 - client certs variations

creating new account: certs.test@wiamail.de
confirmed email/account
add assurances (100 pts)
add experience points (50)

create client cert
a) email 1
   class1
   no name
   enable cert login

   create client cert
   install client cert

   serno: 10D5
   displ.name: CAcert WoT User -> ok
   valid from/to: 2012-02-21 / 2012-03-22 -> ok
   owner: E = certs.test@wiamail.de, CN = CAcert WoT User -> ok

   extended key usage:
    Nicht kritisch
    E-Mail-Schutz (1.3.6.1.5.5.7.3.4)
    TLS-Web-Client-Authentifikation (1.3.6.1.5.5.7.3.2)
    Microsoft-Dateisystemverschlüsselung (1.3.6.1.4.1.311.10.3.4)
    Microsoft servergesperrte Kryptographie (1.3.6.1.4.1.311.10.3.3)
    Netscape servergesperrte Kryptographie (2.16.840.1.113730.4.1)

    certs alternate name
    Nicht kritisch
    E-Mail-Adresse: certs.test@wiamail.de

    => all ok


b) email 1
   class3
   no name
   enable cert login

   create client cert
   install client cert

   serno: 10A1
   displ.name: CAcert WoT User -> ok
   valid from/to: 2012-02-21 / 2012-03-22 -> ok
   owner: E = certs.test@wiamail.de, CN = CAcert WoT User -> ok

   extended key usage:
    Nicht kritisch
    E-Mail-Schutz (1.3.6.1.5.5.7.3.4)
    TLS-Web-Client-Authentifikation (1.3.6.1.5.5.7.3.2)
    Microsoft-Dateisystemverschlüsselung (1.3.6.1.4.1.311.10.3.4)
    Microsoft servergesperrte Kryptographie (1.3.6.1.4.1.311.10.3.3)
    Netscape servergesperrte Kryptographie (2.16.840.1.113730.4.1)

   certs alternate name
    Nicht kritisch
    E-Mail-Adresse: certs.test@wiamail.de

   => all ok

c) email 1
   class1
   "Certs Test"
   enable cert login

   create client cert
   install client cert

   serno: 10D6
   displ.name: Certs Test -> ok

d) email 1
   class3
   "Certs Test"
   enable cert login

   create client cert
   install client cert

   serno: 10A2

e) email 1
   class1
   "Certs Sub Test"
   enable cert login

   create client cert
   install client cert

   serno: 10D7
   displ.name: Certs Sub Test -> ok

   owner: E = certs.test@wiamail.de, CN = Certs Sub Test -> ok
   extended key usage:
    Nicht kritisch
    E-Mail-Schutz (1.3.6.1.5.5.7.3.4)
    TLS-Web-Client-Authentifikation (1.3.6.1.5.5.7.3.2)
    Microsoft-Dateisystemverschlüsselung (1.3.6.1.4.1.311.10.3.4)
    Microsoft servergesperrte Kryptographie (1.3.6.1.4.1.311.10.3.3)
    Netscape servergesperrte Kryptographie (2.16.840.1.113730.4.1)

   certs alternate name
   Nicht kritisch
   E-Mail-Adresse: certs.test@wiamail.de

   => all ok


f) email 1
   class3
   "Certs Sub Test"
   enable cert login

   create client cert
   install client cert

   serno: 10A3
   displ.name: Certs Sub Test -> ok

   owner: E = certs.test@wiamail.de, CN = Certs Sub Test -> ok
   extended key usage:
    Nicht kritisch
    E-Mail-Schutz (1.3.6.1.5.5.7.3.4)
    TLS-Web-Client-Authentifikation (1.3.6.1.5.5.7.3.2)
    Microsoft-Dateisystemverschlüsselung (1.3.6.1.4.1.311.10.3.4)
    Microsoft servergesperrte Kryptographie (1.3.6.1.4.1.311.10.3.3)
    Netscape servergesperrte Kryptographie (2.16.840.1.113730.4.1)

   certs alternate name
   Nicht kritisch
   E-Mail-Adresse: certs.test@wiamail.de

   => all ok

Uli60

2012-02-22 00:28

updater   ~0002841

test 0000002 - server certs variations

using prev account
add domain avintec.com
confirmed avintec.com

openssl genrsa -out test1-avintec-com-512.key 512
openssl req -new -key test1-avintec-com-512.key -out test1-avintec-com-512.csr

paste csr

sign class1
<paste>
submit
error/warning
"The keys that you use are very small and therefore insecure. Please generate stronger keys. More information about this issue can be found in the wiki"
=> ok

sign class3
<paste>
submit
error/warning
"The keys that you use are very small and therefore insecure. Please generate stronger keys. More information about this issue can be found in the wiki"
=> ok



openssl genrsa -out test1-avintec-com-1024.key 1024
openssl req -new -key test1-avintec-com-1024.key -out test1-avintec-com-1024.csr

sign class1
<paste>
submit

Please make sure the following details are correct before proceeding any further.

CommonName: test1.avintec.com
No additional information will be included on certificates because it can not be automatically checked by the system.

submit

returns:
Below is your Server Certificate

-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----

new file test1-avintec-com-1024-signed-c1.key
<paste>

key in list:
     Valid test1.avintec.com 10DA Not Revoked 2012-03-22 23:59:21


openssl x509 -text -in test1-avintec-com-1024-signed-c1.key -noout

....................................................................
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 4314 (0x10da)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=AU, ST=New South Wales, O=CAcert Testserver, OU=http://cacert1
.it-sls.de, CN=CAcert Testserver Root
        Validity
            Not Before: Feb 21 23:59:21 2012 GMT
            Not After : Mar 22 23:59:21 2012 GMT
        Subject: CN=test1.avintec.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
            RSA Public Key: (1024 bit)
                Modulus (1024 bit):
[...]
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 Key Usage: critical
                Digital Signature, Key Encipherment, Key Agreement
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication, Ne
tscape Server Gated Crypto, Microsoft Server Gated Crypto
            Authority Information Access:
                OCSP - URI:http://ocsp.cacert.org/

            X509v3 CRL Distribution Points:
                URI:http://crl.cacert.org/revoke.crl

            X509v3 Subject Alternative Name:
                DNS:test1.avintec.com, othername:<unsupported>
    Signature Algorithm: sha1WithRSAEncryption
[...]
....................................................................

=> ok




sign class3
<paste>
submit

Please make sure the following details are correct before proceeding any further.

CommonName: test1.avintec.com
No additional information will be included on certificates because it can not be automatically checked by the system.

submit

returns:
Below is your Server Certificate

-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----

new file test1-avintec-com-signed-c1.key
<paste>


key in list:
Valid test1.avintec.com 10A6 Not Revoked 2012-03-23 00:02:34

....................................................................
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 4262 (0x10a6)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: O=CAcert Testsever, OU=http://cacert1.it-sls.de, CN=CAcert Tests
erver Class 3
        Validity
            Not Before: Feb 22 00:02:34 2012 GMT
            Not After : Mar 23 00:02:34 2012 GMT
        Subject: CN=test1.avintec.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
            RSA Public Key: (1024 bit)
                Modulus (1024 bit):
[...]
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 Key Usage: critical
                Digital Signature, Key Encipherment, Key Agreement
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication, Ne
tscape Server Gated Crypto, Microsoft Server Gated Crypto
            Authority Information Access:
                OCSP - URI:http://ocsp.cacert.org/

            X509v3 CRL Distribution Points:
                URI:http://crl.cacert.org/class3-revoke.crl

            X509v3 Subject Alternative Name:
                DNS:test1.avintec.com, othername:<unsupported>
    Signature Algorithm: sha1WithRSAEncryption
[...]
....................................................................

=> ok




openssl genrsa -out test1-avintec-com-2048.key 2048
openssl req -new -key test1-avintec-com-2048.key -out test1-avintec-com-2048.csr


sign class1
<paste>
submit

Please make sure the following details are correct before proceeding any further.

CommonName: test1.avintec.com
No additional information will be included on certificates because it can not be automatically checked by the system.

submit

returns:
Below is your Server Certificate

-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----

new file test1-avintec-com-2048-signed-c1.key
<paste>

key in list:
Valid test1.avintec.com 10DB Not Revoked 2012-03-23 00:12:53


openssl x509 -text -in test1-avintec-com-2048-signed-c1.key -noout

....................................................................
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 4315 (0x10db)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=AU, ST=New South Wales, O=CAcert Testserver, OU=http://cacert1
.it-sls.de, CN=CAcert Testserver Root
        Validity
            Not Before: Feb 22 00:12:53 2012 GMT
            Not After : Mar 23 00:12:53 2012 GMT
        Subject: CN=test1.avintec.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
            RSA Public Key: (2048 bit)
                Modulus (2048 bit):
[...]
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 Key Usage: critical
                Digital Signature, Key Encipherment, Key Agreement
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication, Ne
tscape Server Gated Crypto, Microsoft Server Gated Crypto
            Authority Information Access:
                OCSP - URI:http://ocsp.cacert.org/

            X509v3 CRL Distribution Points:
                URI:http://crl.cacert.org/revoke.crl

            X509v3 Subject Alternative Name:
                DNS:test1.avintec.com, othername:<unsupported>
    Signature Algorithm: sha1WithRSAEncryption
[...]
....................................................................

=> ok



sign class3
<paste>
submit

Please make sure the following details are correct before proceeding any further.

CommonName: test1.avintec.com
No additional information will be included on certificates because it can not be automatically checked by the system.

submit

returns:
Below is your Server Certificate

-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----

new file test1-avintec-com-2048-signed-c3.key
<paste>


key in list:
     Valid test1.avintec.com 10A7 Not Revoked 2012-03-23 00:20:44

openssl x509 -text -in test1-avintec-com-2048-signed-c3.key -noout

....................................................................
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 4263 (0x10a7)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: O=CAcert Testsever, OU=http://cacert1.it-sls.de, CN=CAcert Tests
erver Class 3
        Validity
            Not Before: Feb 22 00:20:44 2012 GMT
            Not After : Mar 23 00:20:44 2012 GMT
        Subject: CN=test1.avintec.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
            RSA Public Key: (2048 bit)
                Modulus (2048 bit):
[...]
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 Key Usage: critical
                Digital Signature, Key Encipherment, Key Agreement
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication, Ne
tscape Server Gated Crypto, Microsoft Server Gated Crypto
            Authority Information Access:
                OCSP - URI:http://ocsp.cacert.org/

            X509v3 CRL Distribution Points:
                URI:http://crl.cacert.org/class3-revoke.crl

            X509v3 Subject Alternative Name:
                DNS:test1.avintec.com, othername:<unsupported>
    Signature Algorithm: sha1WithRSAEncryption
[...]
....................................................................

=> ok

Uli60

2012-02-22 00:48

updater   ~0002846

test 3 - client cert login

Valid certs.test@wiamail.de 10A3 Not Revoked 2012-03-22 21:56:34
Valid certs.test@wiamail.de 10D7 Not Revoked 2012-03-22 21:55:49
Valid certs.test@wiamail.de 10A2 Not Revoked 2012-03-22 21:54:57
Valid certs.test@wiamail.de 10D6 Not Revoked 2012-03-22 21:53:42
Valid certs.test@wiamail.de 10A1 Not Revoked 2012-03-22 21:52:39
Valid certs.test@wiamail.de 10D5 Not Revoked 2012-03-22 21:51:09


cert login using:
Ausgestellt auf: E=certs.test@wiamail.de,CN=CAcert WoT User
  Seriennummer: 10:D5
  Gültig von 21.02.2012 22:51:09 an 22.03.2012 22:51:09
  Verwendung eines Zertifikatsschlüssels: unterzeichne,Schlüssel-Verschlüsselung,Schlüssel-Vereinbarung
  E-Mail: certs.test@wiamail.de
Ausgestellt von: CN=CAcert Testserver Root,OU=http://cacert1.it-sls.de,O=CAcert Testserver,ST=New South Wales,C=AU
Gespeichert in: Software-Sicherheitsmodul

=> ok

logout
logout crypto modul

cert login using:
Ausgestellt auf: E=certs.test@wiamail.de,CN=CAcert WoT User
  Seriennummer: 10:A1
  Gültig von 21.02.2012 22:52:39 an 22.03.2012 22:52:39
  Verwendung eines Zertifikatsschlüssels: unterzeichne,Schlüssel-Verschlüsselung,Schlüssel-Vereinbarung
  E-Mail: certs.test@wiamail.de
Ausgestellt von: CN=CAcert Testserver Class 3,OU=http://cacert1.it-sls.de,O=CAcert Testsever
Gespeichert in: Software-Sicherheitsmodul

=> ok

logout
logout crypto modul

cert login using:
Ausgestellt auf: E=certs.test@wiamail.de,CN=Certs Test
  Seriennummer: 10:D6
  Gültig von 21.02.2012 22:53:42 an 22.03.2012 22:53:42
  Verwendung eines Zertifikatsschlüssels: unterzeichne,Schlüssel-Verschlüsselung,Schlüssel-Vereinbarung
  E-Mail: certs.test@wiamail.de
Ausgestellt von: CN=CAcert Testserver Root,OU=http://cacert1.it-sls.de,O=CAcert Testserver,ST=New South Wales,C=AU
Gespeichert in: Software-Sicherheitsmodul

=> ok

logout
logout crypto modul

cert login using:
Ausgestellt auf: E=certs.test@wiamail.de,CN=Certs Test
  Seriennummer: 10:A2
  Gültig von 21.02.2012 22:54:57 an 22.03.2012 22:54:57
  Verwendung eines Zertifikatsschlüssels: unterzeichne,Schlüssel-Verschlüsselung,Schlüssel-Vereinbarung
  E-Mail: certs.test@wiamail.de
Ausgestellt von: CN=CAcert Testserver Class 3,OU=http://cacert1.it-sls.de,O=CAcert Testsever
Gespeichert in: Software-Sicherheitsmodul

=> ok

logout
logout crypto modul

cert login using:
Ausgestellt auf: E=certs.test@wiamail.de,CN=Certs Sub Test
  Seriennummer: 10:D7
  Gültig von 21.02.2012 22:55:49 an 22.03.2012 22:55:49
  Verwendung eines Zertifikatsschlüssels: unterzeichne,Schlüssel-Verschlüsselung,Schlüssel-Vereinbarung
  E-Mail: certs.test@wiamail.de
Ausgestellt von: CN=CAcert Testserver Root,OU=http://cacert1.it-sls.de,O=CAcert Testserver,ST=New South Wales,C=AU
Gespeichert in: Software-Sicherheitsmodul

=> ok

logout
logout crypto modul

cert login using:
Ausgestellt auf: E=certs.test@wiamail.de,CN=Certs Sub Test
  Seriennummer: 10:A3
  Gültig von 21.02.2012 22:56:34 an 22.03.2012 22:56:34
  Verwendung eines Zertifikatsschlüssels: unterzeichne,Schlüssel-Verschlüsselung,Schlüssel-Vereinbarung
  E-Mail: certs.test@wiamail.de
Ausgestellt von: CN=CAcert Testserver Class 3,OU=http://cacert1.it-sls.de,O=CAcert Testsever
Gespeichert in: Software-Sicherheitsmodul

=> ok

Uli60

2012-02-22 01:28

updater   ~0002851

test 4 - org client certs

preparation for test 4 + 5 (once)

make test user OA Admin (Organisation-Admin)

login OrgAssurer
new organisations
  Avintec COM

view organisations
Avintec COM, Germany/Hessen DE Domains (0) Admins (0) Edit Delete
add domain: avintec.com
added.

view organisations
Avintec COM, Germany/Hessen DE Domains (1) Admins (0) Edit Delete
add admin: certs.test@wiamail.de
Department: IT
Master Account: Yes
Comments: ...

view organisations
Avintec COM, Germany/Hessen DE Domains (1) Admins (1) Edit Delete

logout


cert login using:
Ausgestellt auf: E=certs.test@wiamail.de,CN=Certs Sub Test
  Seriennummer: 10:A3
  Gültig von 21.02.2012 22:56:34 an 22.03.2012 22:56:34


3 more menu choices
 - Org Client Certs
 - Org Server Certs
 - Org Admin

Org Admin - View
Organisations
# Organisation Admins
275 Avintec COM, Germany/Hessen DE Admins (1)
796 Domain available avintec.com

=> ok

alice, bob, carol, dave

new org client cert:
  alice@avintec.com class1 Dep1 next
  create
  Installing your certificate
  You are about to install a certificate, if you are using mozilla/netscape based browsers you will not be informed that the certificate was installed successfully, you can go into the options dialog box, security and manage certificates to view if it was installed correctly however.
  Click here to install your certificate.

org client cert - view
       Valid alice@avintec.com 10DC Not Revoked 2012-02-29 01:02:36


new org client cert:
  alice@avintec.com class3 Dep1 next
  create
org client cert - view
     Valid alice@avintec.com 10A8 Not Revoked 2012-02-29 01:04:36
    Valid alice@avintec.com 10DC Not Revoked 2012-02-29 01:02:36


new org client cert:
  bob@avintec.com class1 Dep2 next
  create
org client cert - view
    Valid bob@avintec.com 10DD Not Revoked 2012-02-29 01:06:18
    Valid alice@avintec.com 10A8 Not Revoked 2012-02-29 01:04:36
    Valid alice@avintec.com 10DC Not Revoked 2012-02-29 01:02:36

new org client cert:
  bob@avintec.com class3 Dep2 next
  create
org client cert - view
    Valid bob@avintec.com 10A9 Not Revoked 2012-02-29 01:08:19
    Valid bob@avintec.com 10DD Not Revoked 2012-02-29 01:06:18
    Valid alice@avintec.com 10A8 Not Revoked 2012-02-29 01:04:36
    Valid alice@avintec.com 10DC Not Revoked 2012-02-29 01:02:36


new org client cert:
  carol@avintec.com class1 Dep3 next
  create
org client cert - view
    Valid carol@avintec.com 10DE Not Revoked 2012-02-29 01:10:16
    Valid bob@avintec.com 10A9 Not Revoked 2012-02-29 01:08:19
    Valid bob@avintec.com 10DD Not Revoked 2012-02-29 01:06:18
    Valid alice@avintec.com 10A8 Not Revoked 2012-02-29 01:04:36
    Valid alice@avintec.com 10DC Not Revoked 2012-02-29 01:02:36

new org client cert:
  carol@avintec.com class3 Dep3 next
  create
org client cert - view
     Valid carol@avintec.com 10AA Not Revoked 2012-02-29 01:11:23
    Valid carol@avintec.com 10DE Not Revoked 2012-02-29 01:10:16
    Valid bob@avintec.com 10A9 Not Revoked 2012-02-29 01:08:19
    Valid bob@avintec.com 10DD Not Revoked 2012-02-29 01:06:18
    Valid alice@avintec.com 10A8 Not Revoked 2012-02-29 01:04:36
    Valid alice@avintec.com 10DC Not Revoked 2012-02-29 01:02:36


new org client cert:
  dave@avintec.com class1 Dep4 next
  create
org client cert - view
     Valid dave@avintec.com 10DF Not Revoked 2012-02-29 01:15:07
    Valid carol@avintec.com 10AA Not Revoked 2012-02-29 01:11:23
    Valid carol@avintec.com 10DE Not Revoked 2012-02-29 01:10:16
    Valid bob@avintec.com 10A9 Not Revoked 2012-02-29 01:08:19
    Valid bob@avintec.com 10DD Not Revoked 2012-02-29 01:06:18
    Valid alice@avintec.com 10A8 Not Revoked 2012-02-29 01:04:36
    Valid alice@avintec.com 10DC Not Revoked 2012-02-29 01:02:36

new org client cert:
  dave@avintec.com class3 Dep4 next
  create
org client cert - view
    Valid dave@avintec.com 10AB Not Revoked 2012-02-29 01:15:47
    Valid dave@avintec.com 10DF Not Revoked 2012-02-29 01:15:07
    Valid carol@avintec.com 10AA Not Revoked 2012-02-29 01:11:23
    Valid carol@avintec.com 10DE Not Revoked 2012-02-29 01:10:16
    Valid bob@avintec.com 10A9 Not Revoked 2012-02-29 01:08:19
    Valid bob@avintec.com 10DD Not Revoked 2012-02-29 01:06:18
    Valid alice@avintec.com 10A8 Not Revoked 2012-02-29 01:04:36
    Valid alice@avintec.com 10DC Not Revoked 2012-02-29 01:02:36


checking keys in cert manager:

CAcert Testserver (-> is root, class1)
Alice (10DC), Bob (10DD), Carol (10DE), Dave (10DF)
-and-
CAcert Testserver (-> is subroot, class3)
Alice (10A8), Bob (10A9), Carol (10AA), Dave (10AB)

Alice (10A8)
CN Alice
O Avintec COM
OU Dep1
Ser 10:A8
From 2012-02-22
To 2012-02-29
=> ok

owner:
E = alice@avintec.com
CN = Alice
OU = Dep1
O = Avintec COM
L = Frankfurt/Main
ST = Germany/Hessen
C = DE

=> Ok

extended key usage:
Nicht kritisch
E-Mail-Schutz (1.3.6.1.5.5.7.3.4)
TLS-Web-Client-Authentifikation (1.3.6.1.5.5.7.3.2)
Microsoft-Dateisystemverschlüsselung (1.3.6.1.4.1.311.10.3.4)
Microsoft servergesperrte Kryptographie (1.3.6.1.4.1.311.10.3.3)
Netscape servergesperrte Kryptographie (2.16.840.1.113730.4.1)

cert alternate name
Nicht kritisch
E-Mail-Adresse: alice@avintec.com

=> ok




Dave (10DF)
cN Dave
O Avintec COM
OU Dep4
Ser 10:DF
From 2012-02-22
To 2012-02-29
=> ok

owner:
E = dave@avintec.com
CN = Dave
OU = Dep4
O = Avintec COM
L = Frankfurt/Main
ST = Germany/Hessen
C = DE

=> ok

extended key usage:
Nicht kritisch
E-Mail-Schutz (1.3.6.1.5.5.7.3.4)
TLS-Web-Client-Authentifikation (1.3.6.1.5.5.7.3.2)
Microsoft-Dateisystemverschlüsselung (1.3.6.1.4.1.311.10.3.4)
Microsoft servergesperrte Kryptographie (1.3.6.1.4.1.311.10.3.3)
Netscape servergesperrte Kryptographie (2.16.840.1.113730.4.1)

cert alternate name
Nicht kritisch
E-Mail-Adresse: dave@avintec.com

=> ok

Uli60

2012-02-22 02:12

updater   ~0002856

test 5 - org server certs

Org Server Certs - View
empty list
=> ok

openssl genrsa -out testserver1-avintec-com-512.key 512
openssl req -new -key testserver1-avintec-com-512.key -out testserver1-avintec-com-512.csr

using values from Org Account

Org Server Certs - New
class 1
<paste>
error/warning
The keys that you use are very small and therefore insecure. Please generate stronger keys. More information about this issue can be found in the wiki
=> ok

Org Server Certs - New
class 3
<paste>
error/warning
The keys that you use are very small and therefore insecure. Please generate stronger keys. More information about this issue can be found in the wiki
=> ok



openssl genrsa -out testserver2-avintec-com-1024.key 1024
openssl req -new -key testserver2-avintec-com-1024.key -out testserver2-avintec-com-1024.csr

using values from Org Account

Org Server Certs - New
class 1
<paste>

Please make sure the following details are correct before proceeding any further.

CommonName: testserver2.avintec.com
Organisation: Avintec COM
Org. Unit: UT
Location: Frankfurt/Main
State/Province: Germany/Hessen
Country: DE

Submit

new file
testserver2-avintec-com-1024-signed-c1.key
<paste>

Org Server Certs - View
     Valid testserver2.avintec.com 10E0 Not Revoked 2012-03-23 01:41:16




Org Server Certs - New
class 3
<paste>

Please make sure the following details are correct before proceeding any further.

CommonName: testserver2.avintec.com
Organisation: Avintec COM
Org. Unit: UT
Location: Frankfurt/Main
State/Province: Germany/Hessen
Country: DE

Submit

new file
testserver2-avintec-com-1024-signed-c3.key
<paste>

Org Server Certs - View
    Valid testserver2.avintec.com 10AC Not Revoked 2012-03-23 01:44:33
    Valid testserver2.avintec.com 10E0 Not Revoked 2012-03-23 01:41:16




openssl genrsa -out testserver3-avintec-com-2048.key 2048
openssl req -new -key testserver3-avintec-com-2048.key -out testserver3-avintec-com-2048.csr

using values from Org Account

Org Server Certs - New
class 1
<paste>

Please make sure the following details are correct before proceeding any further.

CommonName: testserver3.avintec.com
Organisation: Avintec COM
Org. Unit: IT
Location: Frankfurt/Main
State/Province: Germany/Hessen
Country: DE

Submit

new file
testserver3-avintec-com-2048-signed-c1.key
<paste>

Org Server Certs - View
     Valid testserver3.avintec.com 10E1 Not Revoked 2012-03-23 01:50:21
    Valid testserver2.avintec.com 10AC Not Revoked 2012-03-23 01:44:33
    Valid testserver2.avintec.com 10E0 Not Revoked 2012-03-23 01:41:16



Org Server Certs - New
class 1
<paste>

Please make sure the following details are correct before proceeding any further.

CommonName: testserver3.avintec.com
Organisation: Avintec COM
Org. Unit: IT
Location: Frankfurt/Main
State/Province: Germany/Hessen
Country: DE

Submit

new file
testserver3-avintec-com-2048-signed-c3.key
<paste>

Org Server Certs - View
    Valid testserver3.avintec.com 10AD Not Revoked 2012-03-23 01:52:37
    Valid testserver3.avintec.com 10E1 Not Revoked 2012-03-23 01:50:21
    Valid testserver2.avintec.com 10AC Not Revoked 2012-03-23 01:44:33
    Valid testserver2.avintec.com 10E0 Not Revoked 2012-03-23 01:41:16


test keys:

openssl x509 -text -in testserver2-avintec-com-1024-signed-c1.key -noout
..........................................................................
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 4320 (0x10e0)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=AU, ST=New South Wales, O=CAcert Testserver, OU=http://cacert1
.it-sls.de, CN=CAcert Testserver Root
        Validity
            Not Before: Feb 22 01:41:16 2012 GMT
            Not After : Mar 23 01:41:16 2012 GMT
        Subject: L=Frankfurt, O=Avintec COM, OU=UT, CN=testserver2.avintec.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
            RSA Public Key: (1024 bit)
                Modulus (1024 bit):
[...]
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 Key Usage: critical
                Digital Signature, Key Encipherment, Key Agreement
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication, Ne
tscape Server Gated Crypto, Microsoft Server Gated Crypto
            Authority Information Access:
                OCSP - URI:http://ocsp.cacert.org/

            X509v3 CRL Distribution Points:
                URI:http://crl.cacert.org/revoke.crl

            X509v3 Subject Alternative Name:
                DNS:testserver2.avintec.com, othername:<unsupported>
    Signature Algorithm: sha1WithRSAEncryption
[...]
..........................................................................

=> ok



openssl x509 -text -in testserver2-avintec-com-1024-signed-c3.key -noout
..........................................................................
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 4268 (0x10ac)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: O=CAcert Testsever, OU=http://cacert1.it-sls.de, CN=CAcert Tests
erver Class 3
        Validity
            Not Before: Feb 22 01:44:33 2012 GMT
            Not After : Mar 23 01:44:33 2012 GMT
        Subject: L=Frankfurt, O=Avintec COM, OU=UT, CN=testserver2.avintec.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
            RSA Public Key: (1024 bit)
                Modulus (1024 bit):
[...]
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 Key Usage: critical
                Digital Signature, Key Encipherment, Key Agreement
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication, Ne
tscape Server Gated Crypto, Microsoft Server Gated Crypto
            Authority Information Access:
                OCSP - URI:http://ocsp.cacert.org/

            X509v3 CRL Distribution Points:
                URI:http://crl.cacert.org/class3-revoke.crl

            X509v3 Subject Alternative Name:
                DNS:testserver2.avintec.com, othername:<unsupported>
    Signature Algorithm: sha1WithRSAEncryption
[...]
..........................................................................

=> ok



openssl x509 -text -in testserver3-avintec-com-2048-signed-c1.key -noout
..........................................................................
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 4321 (0x10e1)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=AU, ST=New South Wales, O=CAcert Testserver, OU=http://cacert1
.it-sls.de, CN=CAcert Testserver Root
        Validity
            Not Before: Feb 22 01:50:21 2012 GMT
            Not After : Mar 23 01:50:21 2012 GMT
        Subject: L=Frankfurt, O=Avintec COM, OU=IT, CN=testserver3.avintec.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
            RSA Public Key: (2048 bit)
                Modulus (2048 bit):
[...]
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 Key Usage: critical
                Digital Signature, Key Encipherment, Key Agreement
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication, Ne
tscape Server Gated Crypto, Microsoft Server Gated Crypto
            Authority Information Access:
                OCSP - URI:http://ocsp.cacert.org/

            X509v3 CRL Distribution Points:
                URI:http://crl.cacert.org/revoke.crl

            X509v3 Subject Alternative Name:
                DNS:testserver3.avintec.com, othername:<unsupported>
    Signature Algorithm: sha1WithRSAEncryption
[...]
..........................................................................

=> ok



openssl x509 -text -in testserver3-avintec-com-2048-signed-c3.key -noout
..........................................................................
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 4269 (0x10ad)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: O=CAcert Testsever, OU=http://cacert1.it-sls.de, CN=CAcert Tests
erver Class 3
        Validity
            Not Before: Feb 22 01:52:37 2012 GMT
            Not After : Mar 23 01:52:37 2012 GMT
        Subject: L=Frankfurt, O=Avintec COM, OU=IT, CN=testserver3.avintec.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
            RSA Public Key: (2048 bit)
                Modulus (2048 bit):
[...]
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 Key Usage: critical
                Digital Signature, Key Encipherment, Key Agreement
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication, Ne
tscape Server Gated Crypto, Microsoft Server Gated Crypto
            Authority Information Access:
                OCSP - URI:http://ocsp.cacert.org/

            X509v3 CRL Distribution Points:
                URI:http://crl.cacert.org/class3-revoke.crl

            X509v3 Subject Alternative Name:
                DNS:testserver3.avintec.com, othername:<unsupported>
    Signature Algorithm: sha1WithRSAEncryption
[...]
..........................................................................

=> ok

Uli60

2012-02-22 02:24

updater   ~0002861

test 6 - admin console view

login admin / OA

Sys Admin - search certs.test@wiamail.de

Certificates
Cert Type: Total Valid Expired Revoked Latest Expire
Server: 4 4 0 0 2012-03-23
Client: 6 6 0 0 2012-03-22
GPG: None
Org Server: 4 4 0 0 2012-03-23
Org Client: 8 8 0 0 2012-02-29


=> ok


Sysadmin - find domain avintec.com


Select Specific Account Details
Domain: 167970 avintec.com
1 rows displayed.


Select Specific Account Details
Domain: 796 avintec.com
1 rows displayed.


1 relates to member account
1 relates to Org account

a) https://cacert1.it-sls.de/account.php?id=43&userid=171296
b) https://cacert1.it-sls.de/account.php?id=26&orgid=275

=> ok

Issue History

Date Modified Username Field Change
2011-01-09 13:06 homer New Issue
2011-01-09 13:07 homer Relationship added related to 0000812
2011-01-09 13:20 homer Description Updated
2011-09-13 21:09 INOPIAE Note Added: 0002423
2011-09-13 22:44 INOPIAE Relationship added related to 0000540
2011-09-21 06:40 jcurl Note Added: 0002479
2012-01-25 17:11 NEOatNHNG Project bugs.cacert.org => Main CAcert Website
2012-02-21 22:19 Uli60 Note Added: 0002835
2012-02-22 00:28 Uli60 Note Added: 0002841
2012-02-22 00:48 Uli60 Note Added: 0002846
2012-02-22 01:28 Uli60 Note Added: 0002851
2012-02-22 02:12 Uli60 Note Added: 0002856
2012-02-22 02:24 Uli60 Note Added: 0002861