I want my cert to show up like this when I double click on it in Windows:

(source: devcentral.f5.com)

If I just double click on a random cert I get this:

The cert that corresponds to that is this:


If I import the signing cert it'll show up like this:

That's fascinating and all but it doesn't tell me how to make a cert say "Ensure the identity of a remote computer". Any ideas?

  • It would be a good idea to update your question saying if you only want HTTPS / SSL for your site and who will be using it? (General customers or people in a corporate environment whom your company manages) Dec 26, 2012 at 16:59

3 Answers 3


If I could use OpenSSL I'd just add following lines to openssl.conf:

keyUsage = digitalSignature

but don't know how add extendedKeyUsage in PHPSecLib

  • 4
    The bit about teh extendedKeyUsage helped. Here's the code to do it in phpseclib: $x509->setExtension('id-ce-extKeyUsage', array('id-kp-serverAuth'));
    – neubert
    Dec 26, 2012 at 17:33


Buy a certificate from Verisign, Comodo, etc and they will make sure you will always get a cert that works for web browsing.

Part 1: "Not enough information to verify"

It appears this is a self signed certificate generated by PHP. It actually says it was issued by "someone". Unless "someone" is a legitimate certificate you want to deploy to every computer (unlikely) then you will get this error.

Launch certificate manager and look at the "trusted root" certificates of Windows for your user account and of the machine (there are two places to check). In that folder (trusted root) that represents all the CAs that are valid for your system. Adding certificates here mean you trust them to control your computer's security, and removing them means you don't trust them. I don't recommend changing this and leaving it to experienced PKI folk to add and remove the contents of this folder.

Otherwise, look at http://security.stackexchange.com for more PKI related information that will educate you on how not to shoot yourself in the foot.

Part 2: "All Application Policies"

The section that says "All Application Policies" includes "Ensure the identity of a remote computer".

If you want to have a more constrained certificate (a good thing) then you should have your PHP application (phplib demo cert) go to a trusted CA and use the appropriate certificate template.

The way you go about this depends on:

  • What utility you generate the certificate (PHP in this case)
  • What CA you use (Is it a public CA for use by all people or in your corporate environment only)
  • CA - specific details on how to constrain the issued certificates to only have the key usages you specify.

Here is a tip, the general tab doesn't show a lot of important information. Click on "Details" and look at the Key usage and Enhanced Key Usage. They will give you not only the friendly text you're looking for, but also the OIDs you will likely need when getting your internal CA to issue the correct cert.


The reason you're having this issue is because you're opening a generic X.509 certificate.

Microsoft requires a PKCS7 certificate which includes the signing CAs. If it doesn't have the signer public certs in the certificate itself (Regardless if the signer public certs are in your local certificate store) it will be considered illegitimate.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .