Making a Windows cert say it's purpose is "Ensures the identity of a remote computer"

Question

I want my cert to show up like this when I double click on it in Windows:

_{(source: devcentral.f5.com)}

If I just double click on a random cert I get this:

The cert that corresponds to that is this:

-----BEGIN CERTIFICATE-----
MIICCzCCAXagAwIBAgIDMTI1MAsGCSqGSIb3DQEBBTBoMQswCQYDVQQGEwJVUzET
MBEGA1UECBMKQ2FsaWZvcm5pYTEWMBQGA1UEBxQNTW91bnRhaW4gVmlldzETMBEG
A1UEChQKR29vZ2xlIEluYzEXMBUGA1UEAxQOd3d3Lmdvb2dsZS5jb20wIhgPMjAx
MjExMjUwNzE0MTJaGA8yMDEzMTIyNTA3MTQxMlowHjEcMBoGA1UECgwTcGhwc2Vj
bGliIGRlbW8gY2VydDCBnTALBgkqhkiG9w0BAQEDgY0AMIGJAoGBAMX7X83YPC92
SGgewurwucf30AQZU4amihKls8J7Bu5l6qv8ONv3JI9qvY8vJKhj6QHZABvFSCk7
/nsilYhptD2MMUjOeosJwvNcqIo5acy/gox/nnInqnCWqhNtQ+DJDrsJEB+NxoNb
1VD9PN0pqF3EsU8EAQgSkRfbdikuFMs1AgMBAAGjDzANMAsGA1UdDwQEAwIHgDAL
BgkqhkiG9w0BAQUDgYEAMtVKyBpbvD2txhlRtA3VHoL1Zp9E7CN/EqFxpAG7bwZT
8D1gifeff4tGH0zkbGvv+5kb5exBZ+PhGsaaHVZoBQVO33Rkr32rfMeMa7PYb76L
i+f0mOp1QfPbrQuvT/uJx8AUv/Owsk5zLyE7JznsvYQ7VeGARRAike2ThHGcZQ8=
-----END CERTIFICATE-----

If I import the signing cert it'll show up like this:

That's fascinating and all but it doesn't tell me how to make a cert say "Ensure the identity of a remote computer". Any ideas?

Answer 1

If I could use OpenSSL I'd just add following lines to openssl.conf:

keyUsage = digitalSignature
extendedKeyUsage=serverAuth

but don't know how add extendedKeyUsage in PHPSecLib

Answer 2

TL;DR

Buy a certificate from Verisign, Comodo, etc and they will make sure you will always get a cert that works for web browsing.

Part 1: "Not enough information to verify"

It appears this is a self signed certificate generated by PHP. It actually says it was issued by "someone". Unless "someone" is a legitimate certificate you want to deploy to every computer (unlikely) then you will get this error.

Launch certificate manager and look at the "trusted root" certificates of Windows for your user account and of the machine (there are two places to check). In that folder (trusted root) that represents all the CAs that are valid for your system. Adding certificates here mean you trust them to control your computer's security, and removing them means you don't trust them. I don't recommend changing this and leaving it to experienced PKI folk to add and remove the contents of this folder.

Otherwise, look at http://security.stackexchange.com for more PKI related information that will educate you on how not to shoot yourself in the foot.

Part 2: "All Application Policies"

The section that says "All Application Policies" includes "Ensure the identity of a remote computer".

If you want to have a more constrained certificate (a good thing) then you should have your PHP application (phplib demo cert) go to a trusted CA and use the appropriate certificate template.

The way you go about this depends on:

• What utility you generate the certificate (PHP in this case)
• What CA you use (Is it a public CA for use by all people or in your corporate environment only)
• CA - specific details on how to constrain the issued certificates to only have the key usages you specify.

Here is a tip, the general tab doesn't show a lot of important information. Click on "Details" and look at the Key usage and Enhanced Key Usage. They will give you not only the friendly text you're looking for, but also the OIDs you will likely need when getting your internal CA to issue the correct cert.

Answer 3

The reason you're having this issue is because you're opening a generic X.509 certificate.

Microsoft requires a PKCS7 certificate which includes the signing CAs. If it doesn't have the signer public certs in the certificate itself (Regardless if the signer public certs are in your local certificate store) it will be considered illegitimate.