Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 3 down vote favorite
1

Well, I am not sure if I specified the question correctly.

While I was browsing web, I checked several SSL certificates and noticed that even Root Certificate doesn't have set all attributes of application(or however is it called). Cert companies makes another attributes for Class 1, Class 2, EV.

When I created my own CA Certificate it has:

-All rules of issue,

-All rules of applications.

And new certificates signed by this root has:

-All rules of applications.

Cert companies makes another attributes for Class 1, Class 2, EV. Is it possible to set those rules using OpenSSL.

share|improve this question

1 Answer

up vote 0 down vote accepted

I had to change usr_cert fields like: keyUsage and extendedKeyUsage to add special policies.

Additionally there is possibility to change nsCertType to change the type of certificate.

share|improve this answer
You should drop all ns*, they're legacy extensions: security.stackexchange.com/a/23037/3272 You answer would also help others better if you elaborated a bit on which (extended)keyUsage you used – Tobias Kienzler Feb 8 at 11:14

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.