I'm having trouble getting Firefox to send an encrypted message using a certificate, and I've found that the only difference between this one and others that work fine are that this one has a DSA public key while the others have an RSA key. The signature algorithm still says "sha512WithRSAEncryption". I'm wondering if that is causing a problem since the public key algorithm is not RSA.

  • If the public key uses DSA but the signature is created using RSA (out at least claims this), how could that work? – mkl Mar 24 '13 at 17:04
  • I do not know. I got the request, imported it into XCA, signed it, exported the resulting cert in PEM format, inspected with openssl x509 and that's what it shows - a DSA key, but a signature algorithm that says RSA. – Shawn J. Goff Mar 24 '13 at 17:08
  • Could it be that the user certificat itself has a DSA key and the CA certificate uses a RSA key? That would be Ok. – mkl Mar 24 '13 at 19:06
  • @mkl That's probably what's happening. The CA key is definitely RSA. The openssl output isn't very clear. – Shawn J. Goff Mar 24 '13 at 19:33

The signature in the certificate is computed by the CA, and must match the public key of the CA. There is no problem with having a certificate which contains a DSA key while being signed by a CA which uses a RSA key.

There is a big problem, though, with trying to encrypt some data with a DSA key. DSA is only for digital signatures.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.